Tool
EfsPotato
- First Reported
- Aug 10, 2026
- Latest Reported
- Sep 8, 2026
Reported Context (2)
- Its Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts. Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
- execution and payload downloads but also capabilities like privilege escalation using BadPotato and EfsPotato, memory dumps, adding user accounts, and executing shellcode. Larva-26010 Targets Korean Web Servers to Install SoftEther VPN
CVE (72)
Malware (4)
Threat Actors (5)
MITRE ATT&CK (10)
Vendors (22)
Products (22)
Tools (11)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.