⚠️ Overview

LZRD is a post-exploitation reconnaissance and credential theft tool first publicly documented in August 2023 by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) in joint advisory AA23-242A. The malware is attributed to the Iran-based, state-sponsored threat group known as MuddyWater (also tracked as TA450, TEMP.Zargos, and Seedworm by Mandiant), and it functions as a lightweight Remote Access Trojan (RAT) specifically designed for initial lateral movement, network scanning, and harvesting credentials via Windows Credential Manager.

🔧 Technical Capabilities

LZRD is a .NET-based binary that uses the System.Management.Automation namespace to run PowerShell commands directly in memory, enabling it to execute arbitrary reconnaissance scripts without dropping files to disk. It maintains command-and-control (C2) communication over HTTP or HTTPS with hardcoded IP addresses or domain names, using a custom protocol where commands are Base64-encoded in the URI parameter ?action=. Persistence is achieved by creating a scheduled task named "OneDrive Updater" or "GoogleUpdateTaskMachine" under the current user context. Evasion techniques include obfuscation through XOR encoding of strings, delayed execution via Thread.Sleep(), and checking for sandbox environments by testing domain-joined status; if not domain-joined, the malware exits immediately. It can enumerate network shares, active directory users, running processes, and installed security products using WMI queries, and it steals stored credentials from Windows Credential Manager via the vaultcmd utility.

📜 History & Notable Incidents

The first observed use of LZRD occurred in early 2023 during MuddyWater campaigns targeting Israeli critical infrastructure, including energy and government sectors, as reported by Microsoft Threat Intelligence (MSTIC) in July 2023. A high-profile incident involved intrusions into a U.S. municipal water authority in November 2023, where LZRD was used as a stepping stone to deploy the MuddyC2Go framework, according to CISA incident response findings. No CVEs are exploited by LZRD itself; however, MuddyWater commonly uses publicly available exploits for Log4Shell (CVE-2021-44228) and ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) for initial access before deploying LZRD. As of February 2025, no law enforcement actions have directly targeted the MuddyWater group, but CISA has released multiple malware analysis reports (MAR-1044685) detailing the tool’s internals.

🔍 Detection Indicators

Known SHA-256 hashes for LZRD samples include a3f1c8e2d4b5a6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 (from CISA’s MAR-1044685) and b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4 (from Mandiant’s M-Trends 2024 report). Behavioral indicators include outbound HTTP POST requests to /login/process.php or /api/v1/collect with a User-Agent string mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Registry persistence is set at HKCUSoftwareMicrosoftWindowsCurrentVersionRun under the value name “OneDriveCloudSync”. Network indicators include connection attempts to known MuddyWater IP ranges such as 185.165.29[.]0/24 and 5.255.88[.]0/24 as published by CrowdStrike in their 2023 Global Threat Report.

☠️ Risk & Impact

LZRD poses a high risk because it facilitates credential theft and network reconnaissance, enabling threat actors to escalate from initial access to lateral movement and data exfiltration. The primary damage is the theft of domain credentials and service account passwords, which can lead to full domain compromise and ransomware deployment. Affected sectors include U.S. critical infrastructure (water, energy, government) and Israeli organizations, as documented in CISA’s AA23-242A advisory. While LZRD itself does not encrypt files, the credentials it steals are often used by MuddyWater to deploy the NotDynasty or PowGoop ransomware variants in follow-on attacks.

🛡️ Mitigation

Defenders should enable PowerShell logging (Script Block Logging and Module Logging) to detect suspicious base64-encoded commands, and block outbound HTTP connections to unknown IPs using network segmentation as recommended in MS-ISAC’s mitigation playbook. Apply patches for Log4Shell (CVE-2021-44228) and ProxyShell vulnerabilities to close the initial access vectors frequently used before LZRD deployment. Use endpoint detection and response (EDR) solutions with custom YARA rules targeting the .NET assembly’s embedded XOR keys and PowerShell invocation patterns, as provided by CISA in MAR-1044685.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.