Lizar
MITRE ATT&CK: S0681 View on attack.mitre.org
Aliases: Tirion, Icebot, DiceLoader, Lizar
- First seen
- 2021-02-01 00:00:00
- Malware type
- rat, loader
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 7 (7 malicious)
- Last IoC activity
- 2026-10-14 00:33:14
- Profile updated
- 2026-07-07 13:21:53
Targeted industries: financial-services retail-and-hospitality
Context
Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.
Recent IoC activity
7 malicious indicators in Maltiverse are attributed to Lizar (S0681). The 7 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 05bb2bd0a43f45b20c54f6fd81351c4e2f024166131c08566e5b80acf20b8ea7 | 2026-10-14 | 1 |
| file sample | 18034aa37b6bfc4bac8e1607c80c6318719e4c5e5eba436e7303a2b006bf3161 | 2026-09-27 | 2 |
| file sample | bcaf5253d24c3bdfb17d9a21ffabb5d2e1c31dff584c6677333a9f34062e8441 | 2026-09-14 | 1 |
| file sample | Dependency.exe | 2026-09-07 | 2 |
| file sample | 814ac8e93b88c3b3bed80e34598a799616f1ba4338deeda4971728f703bc07fa | 2026-09-02 | 1 |
| file sample | 1c441d7d8abb43824a77a15c539e46eafb8f098c5e0efcc57f8b688a12af18dd | 2026-08-18 | 2 |
| file sample | out.dll | 2026-08-11 | 1 |
Detection coverage
- 2 YARA rules
- 630 Sigma rules
Malware & tools used
- Process Injection (attack-pattern)
- Windows Command Shell (attack-pattern)
- Browser Information Discovery (attack-pattern)
- Python (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- Native API (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- LSASS Memory (attack-pattern)
- Windows Credential Manager (attack-pattern)
- Screen Capture (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- PowerShell (attack-pattern)
- Portable Executable Injection (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Email Account (attack-pattern)
- System Information Discovery (attack-pattern)
- Security Software Discovery (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Encrypted Channel (attack-pattern)
- Reflective Code Loading (attack-pattern)
- Tool (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Process Discovery (attack-pattern)
Used by threat actors
- PaperCut Vulnerability Exploitation (campaign)
- FIN7 (threat-actor)
- April 2024 FIN7 Malvertising Campaign (campaign)
Detection rules
- MALPEDIA_Win_Diceloader_Auto (yara-rule)
- SEKOIA_Icebot_Exported_Function (yara-rule)
Reports & references
- bi-zone.medium.com — From Pentest To Apt Attack Cybercriminal Group Fin7 Disguises Its Malware As An Ethical Hackers C23C9A75E319 (report)
- Mandiant — Evolution Of Fin7 (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Diceloader (report)
- MITRE ATT&CK — S0681 (report)
- geminiadvisory.io — Fin7 Ransomware Bastion Secure (report)
- threatpost.com — 166194 (report)
- sentinelone.com — Fin7 Reboot Cybercrime Gang Enhances Ops With New Edr Bypasses And Automated Attacks (report)