H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

LaZagne

[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)

Labels

tool
22 recorded

Relationships

uses
from Akira
Group
uses
from APT3
Group
uses
from APT33
Group
uses
from Evilnum
Group
uses
from Inception
Group
uses
to Cached Domain Credentials
Technique
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Credentials In Files
Technique
uses
to /etc/passwd and /etc/shadow
Technique
uses
to Keychain
Technique
uses
to LSA Secrets
Technique
uses
to LSASS Memory
Technique
uses
to Proc Filesystem
Technique
uses
to Windows Credential Manager
Technique
uses
from Leafminer
Group
uses
from MuddyWater
Group
uses
from OilRig
Group
uses
from Scattered Spider
Group
uses
from TeamTNT
Group
uses
from Tonto Team
Group
uses
from Wizard Spider
Group
4 external

References

mitre-attack
S0349
open
LaZagne
—
GitHub LaZagne Dec 2018
https://github.com/AlessandroZ/LaZagne
open
GitHub LaZange Dec 2018
https://github.com/AlessandroZ/LaZagne
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance