MITRE ATT&CKsoftware (malware)
S9036 LP-Notes
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-04-21
Description
LP-Notes is a C/C++ Windows credential stealer used by MuddyWater. LP-Notes was named after the `lp-notes.txt` file that is used to store stolen credentials.
Related
Uses · MITRE ATT&CK (11)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.001 PowerShell sub-technique
- T1560 Archive Collected Data technique
- T1134.001 Token Impersonation/Theft sub-technique
- T1056.002 GUI Input Capture sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1057 Process Discovery technique
- T1078 Valid Accounts technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ ESET_MuddyWater_Dec2025