Loading malware…
BypassBoss is a custom privilege escalation tool used by the suspected China-nexus APT group Earth Lamia. It was identified via a PDB string naming the tool "BypassBoss" and was observed multiple times across different Earth Lamia incidents. Analysis found it to be a modified version of Sharp4PrinterNotifyPotato, with the original source code reportedly shared on a Chinese forum. In reported operations, BypassBoss was part of post-compromise activity following exploitation of vulnerable public-facing web applications. Earth Lamia used it alongside other intrusion tooling and stealth techniques, including DLL sideloading of malware-laced DLLs into trusted executables such as AppLaunch.exe. The broader campaigns targeted organizations in Brazil, India, and Southeast Asia across sectors including financial services, logistics, online retail, IT, government, and academia. The provided content does not include specific file hashes, network indicators, or detailed command-line artifacts for BypassBoss itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BypassBoss is a custom privilege escalation tool, based on Sharp4PrinterNotifyPotato, developed and used by Earth Lamia to escalate privileges within compromised environments.
BypassBoss is a customized privilege escalation tool used by Earth Lamia, based on the open-source Sharp4PrinterNotifyPotato. It is designed to escalate privileges on compromised systems, with modifications to evade detection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.