FORENSIA

THREAT_ACTOR · G0140

LazyScripter

Also known as: LazyScripter

Profile

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.

MITRE ATT&CK ↗

Techniques

20 ATT&CK techniques attributed to this actor.

T1027.010 Command ObfuscationT1036 MasqueradingT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1071.004 DNST1102 Web ServiceT1105 Ingress Tool TransferT1204.001 Malicious LinkT1204.002 Malicious FileT1218.005 MshtaT1218.011 Rundll32T1547.001 Registry Run Keys / Startup FolderT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1583.001 DomainsT1583.006 Web ServicesT1588.001 MalwareT1608.001 Upload Malware

Software

7 malware/tools attributed to this actor.

KoadicQuasarRATRemcosEmpirenjRATngrokKOCTOPUS

Related corpus activity

10,085 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to LazyScripter.

IndicatorTypeFamilySevSrc
cve-2020-22658cve—852
cve-2025-7852cve—851
cve-2018-8007cve—851
cve-2020-22653cve—852
cve-2021-29441cve—851
cve-2025-7443cve—851
cve-2025-0921cve—852
cve-2024-1781cve—851
cve-2026-3102cve—853
cve-2020-17456cve—851
cve-2026-4368cveransomware851
cve-2021-25646cve—851
cve-2026-3844cve—851
cve-2025-34085cve—851
cve-2022-47945cve—851
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2025-68670cve—852
cve-2025-23304cve—852
cve-2014-2321cve—851
cve-2023-44976cveransomware852
cve-2021-4045cve—851
cve-2025-2492cve—852
cve-2025-34117cve—851
cve-2017-18377cve—851
cve-2013-7471cve—851
cve-2026-1969cve—851
cve-2026-0740cve—851
cve-2025-12057cve—851
cve-2017-17215cve—852

Showing the top 30 by severity of 10,085.