S0681: Lizar

S0681: Lizar describes [Lizar](https://attack.mitre.org/software/S0681) is a modular remote access tool written using the .NET Framework that shares structural similarities to [Carbanak](https://attack.mitre.org/software/S0030). It has likely been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least February 2021.(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)

Executive priority

S0681: Lizar is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0681: Lizar by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0681: Lizar appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Lizar

Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques28 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1055	Process Injection	Lizar can migrate the loader into another process.[1]
Enterprise	T1059.003	Windows Command ShellSub-technique	Lizar has a command to open the command-line on the infected system.[2][1]
Enterprise	T1217	Browser Information Discovery	Lizar can retrieve browser history and database files.[2][1]
Enterprise	T1059.006	PythonSub-technique	Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.[1]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.[1]
Enterprise	T1095	Non-Application Layer Protocol	Lizar has used a raw TCP connection to communicate with the C2 server.CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1106	Native API	Lizar has used various Windows API functions on a victim's machine.[1]
Enterprise	T1027	Obfuscated Files or Information	Lizar has obfuscated the fingerprint of the victim system, the local IP address, and the Fowler-Noll-V 1 (FNV-1) hash of the local IP address using an XOR operation. The data is then sent to the C2 server.CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1003.001	LSASS MemorySub-technique	Lizar can run Mimikatz to harvest credentials.[2][1]
Enterprise	T1555.004	Windows Credential ManagerSub-technique	Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.[1]
Enterprise	T1113	Screen Capture	Lizar can take JPEG screenshots of an infected system.[2][1] Lizar has also used a plugin to take a screenshot of the infected system.[1]
Enterprise	T1033	System Owner/User Discovery	Lizar can collect the username from the system.[1]CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1140	Deobfuscate/Decode Files or Information	Lizar has decrypted its configuration data, such as the C2 IP address, ports and other network communication.[1]CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1059.001	PowerShellSub-technique	Lizar has used PowerShell scripts.[1]
Enterprise	T1055.002	Portable Executable InjectionSub-technique	Lizar can execute PE files in the address space of the specified process.[1]
Enterprise	T1105	Ingress Tool Transfer	Lizar can download additional plugins, files, and tools.[1]CitationSekoiaBourhis_DiceLoader_Feb2024[4]
Enterprise	T1082	System Information Discovery	Lizar can collect the computer name from the machine.[1]CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1518.001	Security Software DiscoverySub-technique	Lizar can search for processes associated with an anti-virus product from list.[1]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Lizar has a module to collect usernames and passwords stored in browsers.[1]
Enterprise	T1573	Encrypted Channel	Lizar can support encrypted communications between the client and server.[2][1][4]
Enterprise	T1620	Reflective Code Loading	Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1588.002	ToolSub-technique	FIN7 has obtained and used tools such as Impacket, Mimikatz, and PsExec.[1]
Enterprise	T1016	System Network Configuration Discovery	Lizar has retrieved network information from a compromised host, such as the MAC address.[1]CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1057	Process Discovery	Lizar has a plugin designed to obtain a list of processes.[2][1]
Enterprise	T1132.002	Non-Standard EncodingSub-technique	Lizar has used a complex XOR operation to obfuscate C2 communications.CitationSekoiaBourhis_DiceLoader_Feb2024
Enterprise	T1560	Archive Collected Data	Lizar has encrypted data before sending it to the server.[1]
Enterprise	T1049	System Network Connections Discovery	Lizar has a plugin to retrieve information about all active network sessions on the infected server.[1]
Enterprise	T1087.003	Email AccountSub-technique	Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.[1]

Associated objects

Groups, software, and campaigns

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.0
Created: Feb 2, 2022, 21:05 UTC (UTC+00:00)
Modified: Oct 3, 2025, 14:46 UTC (UTC+00:00)
Raw hash: 856fc8d913bc5725...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.0	Oct 3, 2025, 14:46 UTC (UTC+00:00)	Current bundle	`856fc8d913bc…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.0	Oct 3, 2025, 14:46 UTC (UTC+00:00)	Older bundle	`856fc8d913bc…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
BiZone Lizar May 2021
BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.
Open source URL
[2]
Threatpost Lizar May 2021
Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.
Open source URL
[3]
Gemini FIN7 Oct 2021
Gemini Advisory. (2021, October 21). FIN7 Recruits Talent For Push Into Ransomware. Retrieved February 2, 2022.
Open source URL
[4]
Cocomazzi FIN7 Reboot
Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.
Open source URL
[5]
DiceLoader
(Citation: Cocomazzi FIN7 Reboot)
[6]
Icebot
(Citation: Cocomazzi FIN7 Reboot)
[7]
Lizar
(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)
[8]
Tirion
(Citation: BiZone Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)
[9]
mitre-attackS0681
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use