Tirion

Malware updated a month ago (2024-11-29T14:33:53.359Z)
Download STIX
Preview STIX
Tirion, also known as Lizar or DiceLoader, is a type of malware developed by the threat group ITG14, also known as FIN7. First reported in March 2020, Tirion has been observed in numerous ITG14 campaigns up until the end of 2022. This malicious software can infiltrate systems through suspicious downloads, emails, or websites and then exploit and damage the compromised system. It can steal personal information, disrupt operations, and even hold data hostage for ransom. The Domino Backdoor and Loader have been found to share code overlap with the Tirion malware family. This discovery leads analysts to suspect that Domino was created by current or former ITG14 developers. The Domino Backdoor and Loader are part of the same threat landscape, suggesting an evolution or diversification of the initial Tirion malware. In addition to the Domino Backdoor, the attacks also utilized custom PowerShell scripts. These scripts were used to retrieve stored credentials from backup servers, gather system information, and establish an active foothold in the compromised host. This was accomplished by executing the DiceLoader (aka Lizar or Tirion) every time the device boots up. This strategy demonstrates the sophistication and persistence of the threat posed by the Tirion malware and its associated variants.
Description last updated: 2024-05-04T20:25:53.240Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Lizar is a possible alias for Tirion. Lizar, also known as Tirion or Diceloader, is a malicious software developed by the threat group ITG14. It's designed to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operati
4
Diceloader is a possible alias for Tirion. Diceloader is a type of malware, short for malicious software, that is designed to infiltrate and damage computer systems. It can infect systems through various means such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal in
4
FIN7 is a possible alias for Tirion. FIN7, also known as Carbanak, Carbon Spider, Cobalt Group, and Navigator Group, is a notorious cybercrime group that has been active since 2012. The group is recognized for its advanced combination of malware and social engineering tactics, having executed numerous successful attacks against global
3
ITG14 is a possible alias for Tirion. ITG14, a threat actor identified in the cybersecurity industry, has recently been linked to malicious activities involving the Domino Backdoor. X-Force researchers have found substantial evidence connecting the Domino Backdoor to ITG14’s Carbanak Backdoor. The Domino Backdoor not only shares signifi
2
Domino Backdoor is a possible alias for Tirion. The Domino Backdoor is a type of malware that has been linked to multiple threat groups, highlighting the complexity of tracking these actors and their operations. This malicious software, designed to exploit and damage computers or devices, can steal personal information, disrupt operations, or hol
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Loader
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Domino Malware is associated with Tirion. Domino is a malicious software that infiltrated various systems, most notably IBM Domino Server and ESET Mail Security for IBM Domino, causing significant disruptions and data breaches. The malware was particularly potent due to its ability to exploit vulnerabilities in one system and trigger a domiUnspecified
3
Source Document References
Information about the Tirion Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more