H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Lizar

[Lizar](https://attack.mitre.org/software/S0681) is a modular remote access tool written using the .NET Framework that shares structural similarities to [Carbanak](https://attack.mitre.org/software/S0030). It has likely been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least February 2021.(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Lizar](https://attack.mitre.org/software/S0681) is a modular remote access tool written using the .NET Framework that shares structural similarities to [Carbanak](https://attack.mitre.org/software/S0030). It has likely been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least February 2021.(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)

Labels

malware
29 recorded

Relationships

uses
from FIN7
Group
uses
to Archive Collected Data
Technique
uses
to Browser Information Discovery
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Email Account
Technique
uses
to Encrypted Channel
Technique
uses
to Ingress Tool Transfer
Technique
uses
to LSASS Memory
Technique
uses
to Native API
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Non-Standard Encoding
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Portable Executable Injection
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Python
Technique
uses
to Reflective Code Loading
Technique
uses
to Screen Capture
Technique
uses
to Security Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Network Connections Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Tool
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Credential Manager
Technique
9 external

References

mitre-attack
S0681
open
Tirion
—
Lizar
—
DiceLoader
—
Icebot
—
BiZone Lizar May 2021
https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
open
Cocomazzi FIN7 Reboot
https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/
open
Gemini FIN7 Oct 2021
https://geminiadvisory.io/fin7-ransomware-bastion-secure/
open
Threatpost Lizar May 2021
https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance