MALWARE FAMILY

LaZagne

Internal ID: py.lazagne

aliases

Last seen:Mar 17, 2026

Intelligence Profile

The author described LaZagne as an open source project used to retrieve lots of passwords stored on a local computer. It has been developed for the purpose of finding these passwords for the most commonly-used software. It is written in Python and provided as compiled standalone binaries for Linux, Mac, and Windows.

Threat Analysis

LaZagne is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://attack.mitre.org/groups/G0100

→https://attack.mitre.org/groups/G0100/

→https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/

→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia

→https://edu.anarcho-copy.org/Against%20Security%20&%20%20Self%20Security/Group-IB%20RedCurl.pdf

→https://fourcore.io/blogs/threat-hunting-browser-credential-stealing

→https://github.com/AlessandroZ/LaZagne

→https://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes/

→https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/

→https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

py.lazagne

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search LaZagne