Lizar

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[Lizar](https://attack.mitre.org/software/S0681) is a modular remote access tool written using the .NET Framework that shares structural similarities to [Carbanak](https://attack.mitre.org/software/S0030). It has likely been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least February 2021.(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)

Associated Techniques (28)
ID ATT&CK Tactics
T1003.001 LSASS Memory -
T1016 System Network Configuration Discovery -
T1027 Obfuscated Files or Information -
T1033 System Owner/User Discovery -
T1049 System Network Connections Discovery -
T1055 Process Injection -
T1055.001 Dynamic-link Library Injection -
T1055.002 Portable Executable Injection -
T1057 Process Discovery -
T1059.001 PowerShell -
T1059.003 Windows Command Shell -
T1059.006 Python -
T1082 System Information Discovery -
T1087.003 Email Account -
T1095 Non-Application Layer Protocol -
Aliases (315)
Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader Tirion Icebot DiceLoader
Used by Actors (1)
FIN7
Criminal
Metadata
ID: 672
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00