LAGTOY

LAGTOY, also known as HOLERUN, is a custom backdoor associated with the financially motivated initial access activity cluster ToyMaker and previously reported by Mandiant as used by UNC961 (also referred to as Gold Melody and Prophet Spider). Cisco Talos assessed LAGTOY/HOLERUN as the same malware family. The malware is used after exploitation of known vulnerabilities in internet-facing applications, with ToyMaker scanning for vulnerable systems, gaining initial access, conducting reconnaissance and credential harvesting, and deploying LAGTOY within about a week of compromise. In Talos reporting on the 2023 ToyMaker campaign, attackers compromised a victim server, exfiltrated credentials, and deployed LAGTOY during an initial wave of activity; roughly three weeks later, the CACTUS ransomware group used the stolen credentials in a separate follow-on intrusion, supporting an access handoff model.

LAGTOY is designed to contact a hard-coded command-and-control server to retrieve commands for execution. Reported capabilities include creating reverse shells, executing commands on infected endpoints, creating processes, and running commands under specified users with corresponding privileges. Mandiant reported that it can process three commands from its C2 server with an 11,000 millisecond sleep interval between them. In observed intrusions, ToyMaker also used SSH to download Magnet RAM Capture and obtained memory dumps likely for credential theft. High-confidence associations in the provided content link LAGTOY to ToyMaker/UNC961 initial access operations and identify infected hosts as potential precursors to later CACTUS ransomware activity.