HOMETHREATSJuicyPotato
APT / THREAT GROUP

JuicyPotato

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

As described on the Github repository page, "A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM".

Threat Analysis

JuicyPotato is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://asec.ahnlab.com/en/85942/
→https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/
→https://github.com/ohpe/juicy-potato
→https://lifars.com/wp-content/uploads/2020/06/Cryptocurrency-Miners-XMRig-Based-CoinMiner-by-Blue-Mockingbird-Group.pdf
→https://unit42.paloaltonetworks.com/operation-diplomatic-specter/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.juicy_potatoJuicyPotato

External Intelligence

Malpedia: win.juicy_potato

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search JuicyPotato