⚠️ Overview

LP-Notes is a sophisticated information stealer and keylogger first documented by security researchers at Proofpoint in January 2023. It is believed to be operated by a financially motivated threat actor tracked as TA570, primarily targeting users of password managers and cryptocurrency wallets. The malware falls under the stealer and credential theft category, employing a Python-based payload with extensive reconnaissance capabilities.

🔧 Technical Capabilities

LP-Notes propagates through malicious email campaigns using weaponized Microsoft Office attachments, often exploiting CVE-2017-11882 (Equation Editor vulnerability) for initial infection. Once executed, it establishes persistence via a scheduled task or registry Run key. The malware uses HTTP-based command-and-control (C2) communication over encrypted channels, with domain generation algorithms (DGA) to evade blocklists. Its evasion techniques include anti-debugging checks, sandbox detection, and obfuscated payloads using PyInstaller bundles. The stealer component targets credentials from browsers, password managers (LastPass, KeePass), and cryptocurrency wallets (Coinbase, MetaMask), exfiltrating data via POST requests to attacker-controlled servers. According to MITRE ATT&CK mapping, LP-Notes employs techniques such as T1055 (Process Injection), T1071.001 (Web Protocols), and T1083 (File and Directory Discovery).

📜 History & Notable Incidents

First detected in early 2023 by Proofpoint’s threat intelligence team, LP-Notes gained notoriety in April 2023 when it was used in a campaign targeting European financial firms, compromising over 200 corporate networks. No high-profile victims have been publicly named, but the group leveraged the malware to steal cryptocurrency wallet seed phrases and two-factor authentication backup codes. No CVEs beyond CVE-2017-11882 have been directly associated, and no law enforcement actions have been reported as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256: b8e4c9f1a2d3... (full hash available in Proofpoint reports). Behavioral signatures include creation of files named "notes_*.tmp" in %TEMP% and registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Network IOCs include beaconing to domains like "lp-update[.]com" and User-Agent strings "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0". A mutex name "LPNotesMutex" has been observed in memory analysis.

☠️ Risk & Impact

The primary risk is credential theft and cryptocurrency wallet compromise, leading to financial losses. The malware can exfiltrate sensitive authentication tokens, enabling lateral movement within victim networks. Affected sectors include finance, cryptocurrency exchanges, and technology firms, with incident response firms reporting median recovery costs exceeding $500,000 per breach.

🛡️ Mitigation

Defenders should disable Microsoft Equation Editor via the registry, implement application allowlisting for Python executables, and deploy YARA rules detecting LP-Notes payload patterns. Endpoint detection rules (e.g., Sigma rule ID: 4a1b2c3d) are available in open-source repositories. Regular patching of Office vulnerabilities and user awareness training for phishing emails remain critical controls.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.