{
  "family": "lanfiltrator",
  "sample_count": 0,
  "category": "trojan",
  "description": "LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area network (LAN) surveillance, credential harvesting, and data exfiltration tool that surfaced in the mid-2000s cybercrime era. Designed for enterprise network reconnaissance, LanFiltrator enumerates active network nodes, probes open SMB shares, harvests cached domain credentials, captures network traffic, and silently exfiltrates harvested corporate data via outbound FTP or HTTP connections to remote operators.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/LanFiltrator",
    "Spyware.Win32.LanFiltrator",
    "Trojan.LanFiltrator",
    "Win32/LanFiltrator.Spyware",
    "LanFiltrator.Sniffer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the LanFiltrator network spyware threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "LanFiltrator is a network reconnaissance and data exfiltration trojan designed to harvest corporate credentials across LANs."
      }
    },
    {
      "@type": "Question",
      "name": "How does LanFiltrator discover targets on local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans local IP subnets, enumerates accessible SMB shares, and probes active Windows domain workstations."
      }
    },
    {
      "@type": "Question",
      "name": "What data is collected and exfiltrated by LanFiltrator?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures network packet summaries, extracts cached domain credentials, and harvests files from shared network shares."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to LanFiltrator campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing LanFiltrator have exploited document and shortcut flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can enterprise networks prevent LanFiltrator exfiltration?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Segment internal networks, enforce SMB signing and encryption, restrict network sniffing privileges, and monitor egress."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1046",
    "T1087.002",
    "T1135",
    "T1041",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1087.002",
      "name": "Account Discovery: Domain Account",
      "tactic": "Discovery"
    },
    {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to cut active network sniffing and data exfiltration sessions.",
    "Kill active LanFiltrator background service processes and terminate network capture threads.",
    "Delete persistence registry entries located under HKLM and HKCU Run keys.",
    "Enforce immediate credential resets for all domain accounts observed communicating with the infected host."
  ],
  "what_to_avoid": [
    "Do not allow unrestricted broadcast or promiscuous mode packet capture on standard user workstations.",
    "Avoid sharing administrative credentials across multiple network tiers or subnets."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.LanFiltrator",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.LanFiltrator/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Spyware.Win32.LanFiltrator",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/lanfiltrator"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2005,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Network Sniffer Spyware Frameworks"
    ],
    "variants": [
      "LanFiltrator v1.0",
      "LanFiltrator Pro",
      "Win32/LanFiltrator.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f",
      "6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b"
    ],
    "delivery": [
      "Spear-phishing emails containing malicious Microsoft Office attachments exploiting CVE-2012-0158",
      "Internal lateral movement via compromised network shares exploiting CVE-2010-2568"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LanFiltratorService",
      "Scheduled Task created under Microsoft\\Windows\\LanFiltratorScan"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}