Tirion

Tirion, also known as Lizar or DiceLoader, is a type of malware developed by the threat group ITG14, also known as FIN7. First reported in March 2020, Tirion has been observed in numerous ITG14 campaigns up until the end of 2022. This malicious software can infiltrate systems through suspicious downloads, emails, or websites and then exploit and damage the compromised system. It can steal personal information, disrupt operations, and even hold data hostage for ransom. The Domino Backdoor and Loader have been found to share code overlap with the Tirion malware family. This discovery leads analysts to suspect that Domino was created by current or former ITG14 developers. The Domino Backdoor and Loader are part of the same threat landscape, suggesting an evolution or diversification of the initial Tirion malware. In addition to the Domino Backdoor, the attacks also utilized custom PowerShell scripts. These scripts were used to retrieve stored credentials from backup servers, gather system information, and establish an active foothold in the compromised host. This was accomplished by executing the DiceLoader (aka Lizar or Tirion) every time the device boots up. This strategy demonstrates the sophistication and persistence of the threat posed by the Tirion malware and its associated variants.