MalwareExploits 1 CVE

SweetPotato

SweetPotato is a Windows privilege-escalation utility in the Potato-family of tools. It has been used after compromise of Windows IIS and other servers to elevate execution from a restricted service context, including the IIS worker process, toward SYSTEM-level privileges. Observed variants include modified builds adapted for execution through web-shell environments and in-memory .NET loading. SweetPotato-related activity has involved token-spoofing techniques and execution of elevated processes for follow-on operations. It has appeared alongside other Potato-family tools, such as JuicyPotato, BadPotato, and GodPotato, in server intrusions involving web shells, post-exploitation reconnaissance, and attempted lateral movement. Its use has been reported in activity attributed or linked with varying confidence to Lazarus and Gelsemium, as well as in attacks against South Korean web servers; use of this publicly available tool alone is not sufficient for attribution.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2019-18935Remote Code Execution in Telerik UI for ASP.NET AJAX RadAsyncUploadExploited in the wild

CVE-2019-18935 is a .NET deserialization vulnerability in RadAsyncUpload, a file upload feature; if exploited, a threat actor can perform remote code execution with the privileges of the w3wp.exe process on an IIS web server.

via ahnlab asec blogasec.ahnlab.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

Persistence

1 technique

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

Privilege Escalation

5 techniques

T1068Exploitation for Privilege EscalationEvidence8

The threat actor conducted ... privilege escalation through customised tools like JuicyPotato, RottenPotato, and SweetPotato.

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

T1134Access Token ManipulationEvidence1

Potato-family privilege escalation tools ... use token spoofing techniques, such as PrintSpoofer, to gain SYSTEM privileges.

T1134.001Token Impersonation/TheftEvidence1

SeImpersonatePrivilege (“ Impersonate a client after authentication ”) allows a thread to impersonate any access token through SetThreadToken() , ImpersonateLoggedOnUser() , or CreateProcessWithToken() .

T1548Abuse Elevation Control MechanismEvidence1

Potato types escalate privilege by abusing some processes with certain privileges activated. Afterward, the threat actor is able to perform malicious behaviors using the elevated privilege.

Stealth

4 techniques

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

T1134Access Token ManipulationEvidence1

Potato-family privilege escalation tools ... use token spoofing techniques, such as PrintSpoofer, to gain SYSTEM privileges.

T1134.001Token Impersonation/TheftEvidence1

T1620Reflective Code LoadingEvidence1

several .NET modules began to appear in the memory of the IIS worker process (w3wp.exe)... used several variants of the well-known Potato tools, either as memory-only modules

Credential Access

2 techniques

T1187Forced AuthenticationEvidence1

Using Potato exploits , a family of well-known local privilege-escalation techniques ... that abuse these privileges by coercing SYSTEM-level COM/RPC authentication back to an attacker-controlled listener

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence1

Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture

Collection

1 technique

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence1

Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

ahnlab asec blogNews

Sep 27, 2026

Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability - ASEC

A modified Potato-family token-spoofing privilege-escalation tool used to obtain SYSTEM privileges and launch elevated processes such as cmd.exe.

ahnlab asec blogNews

Jun 23, 2025

Attacks on South Korean Web Servers Using MeshAgent and SuperShell

SweetPotato is a privilege escalation exploit used to gain SYSTEM-level access on Windows systems, often leveraged in post-exploitation phases.

securelistNews

Mar 4, 2025

Kaspersky SOC analyzes an incident involving a web shell used as a backdoor | Securelist

A Potato-family privilege-escalation module observed in memory and used by the attackers in an attempt to elevate privileges.

palo alto networks unit 42 blogNews

Sep 22, 2023

Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

Potato-family local privilege escalation tool used in attempted privilege escalation.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SweetPotato