Potato suite
Potato Suite is a collection of privilege-escalation tools referenced in reporting on multiple China-linked intrusion sets. In the provided content, it is used to attempt escalation to SYSTEM privileges on compromised Windows hosts, including during attacks against Microsoft IIS servers. ReliaQuest reported that the China-linked espionage cluster OP-512 used Potato Suite in post-compromise privilege-escalation attempts after deploying web shells on legacy IIS environments, including a Windows Server 2016 system with an outdated .NET Framework. Palo Alto Networks Unit 42 and related reporting also list Potato Suite among the common tools used by the Chinese state-sponsored actor Phantom Taurus alongside China Chopper and Impacket. The content does not provide specific module names, infection vectors, or standalone indicators of compromise for Potato Suite itself.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OP-512 also attempts privilege escalation to the SYSTEM level using the Potato Suite.
“The group uses common Chinese nation-state hacking tools such as the China Chopper web shell, Potato suite and Impacket...”
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 techniqueOP-512 also attempts privilege escalation to the SYSTEM level using the Potato Suite.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A post-exploitation privilege escalation toolkit used to elevate access to SYSTEM on compromised Windows hosts.
Collection of Windows privilege-escalation tools referenced as used by Phantom Taurus.
Collection of Windows privilege-escalation tools (commonly leveraging token/impersonation techniques) used post-compromise to elevate privileges.
Collection of Windows privilege-escalation tools (commonly leveraging token/impersonation techniques) used post-compromise to elevate privileges.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.