APT / THREAT GROUP

LaZagne

aliases

Last seen:Mar 17, 2026

Intelligence Profile

The author described LaZagne as an open source project used to retrieve lots of passwords stored on a local computer. It has been developed for the purpose of finding these passwords for the most commonly-used software. It is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.

Threat Analysis

LaZagne is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://attack.mitre.org/groups/G0100

→https://attack.mitre.org/groups/G0100/

→https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/

→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia

→https://edu.anarcho-copy.org/Against%20Security%20&%20%20Self%20Security/Group-IB%20RedCurl.pdf

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

py.lazagneLaZagne

External Intelligence

Malpedia: py.lazagne

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search LaZagne