LaZagne
LaZagne is an open-source password recovery and credential theft tool used to retrieve passwords stored on a local computer. It is designed to extract credentials across multiple platforms, including Windows, Linux, and macOS, and supports numerous sources such as web browsers, chat applications, databases, mail clients, Wi-Fi profiles, operating system credential stores, and various sysadmin and file transfer tools. Reported supported targets include browsers such as Chrome, Firefox, Edge, Opera, Brave, Chromium, Vivaldi, and Yandex; mail clients such as Outlook and Thunderbird; chat applications such as Pidgin, Psi, and Skype; database tools such as DBVisualizer and PostgreSQL; and tools such as FileZilla, OpenSSH, OpenVPN, WinSCP, CyberDuck, mRemoteNG, PuttyCM, Rclone, RDPManager, and VNC. It can also access internal credential stores and artifacts including Autologon, MSCache, Credential Files, Credman, DPAPI, LSA secrets, Vault files, GNOME Keyring, Kwallet, LM/NT hashes, and on Linux items such as AWS and Docker environment variables, SSH private keys, and Wi-Fi credentials. On Windows, administrator privileges are required for some sources such as Wi-Fi passwords and Windows Secrets. LaZagne supports output in text and JSON formats and can run all modules or selected modules only.
The tool is also notable for in-memory use through the Pupy post-exploitation framework, where its Python code can be interpreted without touching disk. Detection-focused reporting notes that LaZagne and similar browser credential extraction tools commonly read fixed browser storage paths, including Firefox files such as cookies.sqlite, key3.db, key4.db, and logins.json, and Chromium-family files such as Login Data, Network Cookies, and Local State.
LaZagne is widely used by threat actors as a publicly available dual-use credential harvesting utility. The provided content explicitly associates its use with APT33, APT15, Inception, MuddyWater, OilRig, Leafminer, Pupy, RedCurl, Akira ransomware operators, Beast Ransomware operators, and YoroTrooper-derived tooling, among others. Reported operational use includes harvesting credentials from infected systems, browsers, databases, email clients, Outlook Web Access, Wi-Fi, files, and Windows Registry-stored secrets to support privilege escalation, lateral movement, persistence, and broader post-compromise activity. The content also references LaZagne being used alongside tools such as Mimikatz, Meterpreter, Metasploit, Invoke-Obfuscation, Browser64, HackBrowserData, and Automim.
High-confidence behavior described in the content includes obtaining credentials from chats, databases, mail, Wi-Fi, browsers, and files across multiple platforms; recovering stored passwords from local systems; and being used in intrusion chains by both espionage and ransomware actors. Detection-relevant artifacts mentioned in the content include command-line keywords such as 'browsers', 'Databases', 'Mails', and 'Sysadmin'; default execution from AppData\Local\Temp in some cases; loading of Python27.dll and a bundled SQLite3 DLL in some detections; and access to browser credential files under %LOCALAPPDATA%.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Inception has obtained and used open-source tools such as LaZagne.
Inception has obtained and used open-source tools such as LaZagne.
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
For example, APT15 uses widely accessible tools like Mimikatz and LaZagne... APT15 used the Mimikatz and LaZagne tools
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
LaZagne can obtain credentials from chats, databases, mail, and WiFi.
LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.
Credential stealers used by YoroTrooper are either custom scripts, which in some cases are based on the open-sourced Lazagne project...
APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials... LaZagne can perform credential dumping from memory to obtain account and password information.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueThe content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
Execution
1 techniqueThe hackers used well known tools, including Meterpreter, Mimikatz, Lazagne, Invoke-Obfuscation, and more.
Credential Access
15 techniquesCredential Access [TA0006]... Tools such as Mimikatz, Lazagne, and WebBrowserPassView remain popular and prominent.
or targeting the local security authority (LSA) secrets (T1003.001) in Windows systems.
T1003.004 MuddyWater has performed credential dumping with LaZagne.
T1003.005 MuddyWater has performed credential dumping with LaZagne.
Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases, etc.).
Environnement variable FileZilla gFTP History files Shares SSH private keys KeePass Configuration Files
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.
The content references theft of saved passwords and stored credentials from victim applications and password stores, including tools such as LaZagne and Mimikatz that can acquire credentials from multiple sources.
Internal mechanism passwords storage Autologon MSCache Credential Files Credman DPAPI Hash Hashdump (LM/NT) LSA secret Vault Files
KeePass Configuration Files (KeePass1, KeePass2)
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential dumping tool used to harvest credentials during the attack chain before the encryptor was deployed.
Credential recovery tool used to dump passwords from browsers, databases, email clients, and memory as part of Beast ransomware operations.
Open-source credential recovery utility used to extract stored passwords from compromised systems.
LAZAGNE is a credential stealer tool used to extract saved passwords from infected systems. In this campaign, it is deployed via PowerShell scripts as part of the attack chain.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.