LP-Notes

LP-Notes is a custom credential stealer associated with the Iran-aligned threat actor MuddyWater (also tracked as Mango Sandstorm and TA450). Reporting in the provided content places it in MuddyWater campaigns targeting organizations primarily in Israel, with at least one confirmed target in Egypt, across sectors including technology, engineering, manufacturing, local government, education, telecom, government, oil, and energy. LP-Notes was used post-compromise alongside other MuddyWater tooling such as the Fooder loader, the MuddyViper backdoor, CE-Notes, Blub, VAX One, and go-socks5 reverse tunnels.

The malware is described as a credential stealer written in C/C++. Its documented behavior includes stealing Windows credentials by presenting a fake Windows Security dialog box to trick users into entering their system username and password. Multiple sources in the content also describe LP-Notes as staging and verifying stolen credentials. It was used to extract login credentials and other sensitive data, and one cited artifact states that collected credentials were stored in C:\Users\Public\Downloads\lp-notes.txt.

High-confidence indicators and behaviors directly mentioned in the content include the malware name LP-Notes / LP Notes, use of a fake Windows Security prompt for credential theft, local staging of stolen credentials, and storage of collected credentials in C:\Users\Public\Downloads\lp-notes.txt. The content consistently links LP-Notes to MuddyWater operations observed from late 2024 into 2025.