MalwareUsed by 1 actor

BadPotato

BadPotato is a Windows local privilege-escalation tool/exploit used to elevate execution to NT AUTHORITY\SYSTEM. The provided content consistently describes it as part of the Potato-family privilege-escalation toolkit, similar to SharpToken, and specifically notes abuse of named-pipe impersonation to obtain SYSTEM-level command execution. It has been observed as a DLL named BadPotato.dll, including an in-memory sample with MD5 B8A468615E0B0072D2F32E44A7C9A62F. BadPotato has been used by multiple threat actors and intrusion clusters, including APT41, which used a ConfuserEx-obfuscated BADPOTATO exploit for local SYSTEM privilege escalation during campaign C0017, and other China-linked activity clusters such as DragonSpark and Unit 42’s CL-STA-0048 and CL-STA-0046. In those cases it was used post-compromise alongside other tooling such as JuicyPotato, SweetPotato, RasmanPotato, and SharpToken after initial access to internet-exposed servers or web applications. The content also notes a CLR SqlShell variant named CLR_module that embeds BadPotato and EfsPotato for use in compromised Microsoft SQL Server environments. High-confidence indicators from the content include the filename BadPotato.dll and MD5 B8A468615E0B0072D2F32E44A7C9A62F.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DragonSpark

BadPotato: a tool similar to SharpToken that elevates user privileges to SYSTEM for command execution.

via sentinelone labssentinelone.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence2

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Initial Access

1 technique

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

Persistence

1 technique

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence3

To gain system privileges, the threat actors used several variants of the well-known Potato tools, either as memory-only modules or as standalone executables... Of all the tools, the GodPotato standalone binary ultimately succeeded in gaining system privileges.

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

T1548Abuse Elevation Control MechanismEvidence1

SharpToken: a privilege escalation tool that enables the execution of Windows commands with SYSTEM privileges... BadPotato: a tool similar to SharpToken that elevates user privileges to SYSTEM for command execution.

Stealth

2 techniques

T1078.003Local AccountsEvidence1

Using tools such as BadPotato, SweetPotato, GodPotato, or PrinterNotifyPotato for privilege escalation on Windows systems

T1620Reflective Code LoadingEvidence1

several .NET modules began to appear in the memory of the IIS worker process (w3wp.exe)... used several variants of the well-known Potato tools, either as memory-only modules

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

sentinelone labsNews

Apr 11, 2025

DragonSpark | Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation | SentinelOne

A privilege escalation tool used to obtain SYSTEM-level execution on Windows.

securelistNews

Mar 4, 2025

Kaspersky SOC analyzes an incident involving a web shell used as a backdoor | Securelist

A Potato-family privilege-escalation module observed loaded in IIS worker process memory during post-exploitation.

palo alto networks unit 42 blogNews

Jan 29, 2025

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

A local privilege escalation tool from the Potato Suite used to elevate privileges to SYSTEM for command execution.

palo alto networks unit 42 blogNews

Sep 22, 2023

Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

Potato-family local privilege escalation tool used in attempted privilege escalation.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.