Lizar
Software · ATTACK:enterprise:S0681
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0681",
"title": "Lizar",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0681",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f74a5069-015d-4404-83ad-5ca01056c0dc",
"external_id": "S0681",
"domain": "enterprise",
"created": "2022-02-02T21:05:48.601Z",
"modified": "2025-10-03T14:46:54.018Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Tirion"
},
{
"source_name": "Lizar"
},
{
"source_name": "DiceLoader"
},
{
"source_name": "Icebot"
},
{
"source_name": "BiZone Lizar May 2021",
"url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
},
{
"source_name": "Cocomazzi FIN7 Reboot",
"url": "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"
},
{
"source_name": "Gemini FIN7 Oct 2021",
"url": "https://geminiadvisory.io/fin7-ransomware-bastion-secure/"
},
{
"source_name": "Threatpost Lizar May 2021",
"url": "https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07c87a67-32d0-4b86-9345-aad1a0241340
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08d8941b-e4be-44f1-8a3f-765b8f5d1196
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1be14720-a61a-4ac6-a6f6-f84c74c60d43
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e088415-be6b-4912-9e1a-ac542b7bbe48
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--410ec59e-9e11-4acc-98d6-4d7c63f09c8d
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--432e82e0-54e5-487b-a538-6fc49d7cfc5c
SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44927ff0-b153-4122-a881-ff078a3e81cd
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--451a9d37-4e16-4822-85db-821b1dd49ddc
SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58b1c6e7-5481-4162-a90c-0b7122c3680d
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d925633-c463-4ca8-afb7-888505c70633
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--638b21af-b5d5-44dd-9d14-ea3c2be3eb4e
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f037ffb-3e85-41d0-8c48-ae36d0996d57
BiZone Lizar May 2021 · SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b8ff6e6-8b67-4182-9752-fa1cf15c0485
BiZone Lizar May 2021 · SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d239ea5-b191-4e30-9d0c-fd5ee69e621d
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e13c22e-5758-4e8f-920c-7dbab940b02b
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a19231c9-e6b4-4d3f-9c9d-f4e85cba5e3a
BiZone Lizar May 2021 · SekoiaBourhis_DiceLoader_Feb2024 · Cocomazzi FIN7 RebootATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1087.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a23d8e4f-6e3c-4b07-a63a-216764d61ec0
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aaa42f0a-5709-45e2-81d3-0687b3c72cc9
BiZone Lizar May 2021 · SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5a6b7ee-7c1b-41c6-91d8-554ca468426e
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba93bce7-7214-45e9-9deb-4fefb5038aab
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c77046c5-1ea2-4d3f-a19e-0ea7141d7e9c
BiZone Lizar May 2021 · Cocomazzi FIN7 Reboot · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cce28b98-698e-4c0b-b625-78b125cf8837
SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2a28088-7488-40ce-9f65-a01834721a8c
BiZone Lizar May 2021ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0681
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d736ba76-c58b-4010-865e-68cd67fae4bf
Gemini FIN7 Oct 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd18682c-873d-4b26-b41a-2696101f8eb8
BiZone Lizar May 2021 · SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9a96b5e-5d6c-46c7-85df-ff16d1efeb4d
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f32a117b-006e-4d4e-97c8-1fe1f91fefdf
SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff9e8d81-dc74-4494-a4aa-54f8039f9ad7
BiZone Lizar May 2021ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffcfa61b-2b35-4d06-9298-836fe50f5bed
BiZone Lizar May 2021