HOMETHREATSJuicyPotato
MALWARE FAMILY

JuicyPotato

Internal ID: win.juicy_potato
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

As described on the Github repository page, "A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM".

Threat Analysis

JuicyPotato is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://asec.ahnlab.com/en/85942/
→https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/
→https://github.com/ohpe/juicy-potato
→https://lifars.com/wp-content/uploads/2020/06/Cryptocurrency-Miners-XMRig-Based-CoinMiner-by-Blue-Mockingbird-Group.pdf
→https://unit42.paloaltonetworks.com/operation-diplomatic-specter/
→https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/
→https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf
→https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html
→https://www.welivesecurity.com/2021/08/09/iispy-complex-server-side-backdoor-antiforensic-features/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.juicy_potato

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search JuicyPotato