{
  "family": "lazagne",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Lazagne is an open-source, highly versatile **Credential Dumper** and password recovery utility available on GitHub. While designed for legitimate penetration testing and sysadmin password recovery, it is almost exclusively seen in the wild as a weaponized post-exploitation tool (`T1003`). Once an attacker breaches a network, they deploy Lazagne to automatically harvest saved passwords, SSH keys, and tokens from dozens of supported applications (browsers, chat clients, databases, sysadmin tools) stored on the compromised endpoint.<br><br><b>Understanding the Lazagne Threat</b><br>To an IT administrator, Lazagne might seem like a useful recovery utility. To a SOC analyst, the execution of `lazagne.exe` (or its Python script equivalent) is a 'Code Red' indicator of a severe, interactive network breach. It means an attacker has bypassed perimeter defenses, escalated privileges on a host, and is now attempting to harvest credentials to pivot laterally across the enterprise domain.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Lazagne is typically dropped onto a victim machine *after* an initial compromise (e.g., via a phishing payload or an RDP brute-force attack) (`T1105`). The attacker usually executes it from a command shell with administrative privileges (`T1059.003`). Lazagne then automatically iterates through its modules (`T1082`). It queries the Windows Registry (`T1012`), parses SQLite databases used by browsers like Chrome and Firefox (`T1555.003`), extracts Wi-Fi profiles (`T1555.004`), and decrypts stored credentials using the Windows Data Protection API (DPAPI) (`T1555.004`). It outputs the harvested credentials in cleartext to the console or a text file for the attacker to exfiltrate.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the mass compromise of user identities, potentially granting the attacker Domain Admin privileges if an admin recently logged into the box. Host-based IoCs include EDR alerts for the execution of `lazagne.exe` (often renamed to evade simple blacklists), or alerts for anomalous processes querying multiple browser profile directories and DPAPI functions in rapid succession. The presence of a newly created `passwords.txt` or `creds.json` file in a temporary directory is a strong indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Lazagne and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lazagne is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lazagne establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lazagne typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Lazagne compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Lazagne should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Lazagne leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lazagne frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lazagne maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lazagne often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1555.004",
    "T1003",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003",
      "name": "OS Credential Dumping (Using Lazagne to extract hashes/cleartext)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Dropping the tool post-compromise)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager (DPAPI extraction)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; if Lazagne was executed, an attacker has interactive control.",
    "Assume all credentials stored on or entered into the compromised machine have been stolen. Force an immediate password reset for the user's Active Directory account.",
    "If an IT administrator recently logged into the compromised machine via RDP or PsExec, you must assume the Domain Admin credentials were also dumped.",
    "Search EDR logs enterprise-wide for the specific file hash of the Lazagne executable found, as the attacker likely deployed it to multiple machines."
  ],
  "what_to_avoid": [
    "Do not allow users to save corporate passwords in web browsers; enforce the use of secure, enterprise password managers that do not store credentials in easily parsed SQLite files.",
    "Avoid treating Lazagne detection as a 'low severity' PUA/HackTool alert; it is a critical indicator of post-exploitation activity."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}