Loading malware…
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Threat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
RemotePotato0 is a method for coercing privileged authentication on a target machine by taking advantage of standard COM marshaling.
The newly created process 12.log (Spof.Data) is linked to a publicly available privilege escalation tool named PrintSpoofer... Juicy.Data was another publicly available privilege escalation tool named JuicyPotatoNG.
From classic token manipulation to the Potato family of exploits, this topic has defined a large part of Windows local privilege escalation research over the past 10 years.
SeImpersonatePrivilege (“ Impersonate a client after authentication ”) allows a thread to impersonate any access token through SetThreadToken() , ImpersonateLoggedOnUser() , or CreateProcessWithToken() .
From classic token manipulation to the Potato family of exploits, this topic has defined a large part of Windows local privilege escalation research over the past 10 years.
SeImpersonatePrivilege (“ Impersonate a client after authentication ”) allows a thread to impersonate any access token through SetThreadToken() , ImpersonateLoggedOnUser() , or CreateProcessWithToken() .
Using Potato exploits , a family of well-known local privilege-escalation techniques ... that abuse these privileges by coercing SYSTEM-level COM/RPC authentication back to an attacker-controlled listener
Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture
Intercepting NTLM or Kerberos authentication by using techniques such as coercion, relay attacks, or credential capture
"...виявлено новий інструментарій... ...шкідливі програми LOADGRIP та BIASBOAT..."
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.