Home > List all groups > List all tools > List all groups using tool LoFiSe

Threat Group Cards: A Threat Actor Encyclopedia

Names	LoFiSe
Category	Malware
Type	Exfiltration
Description	(Kaspersky) This is a component designed to find and collect files of interest on targeted systems. The name LoFiSe derived from the mutex name used by this tool (‘MicrosoftLocalFileService’). The tool itself is a DLL file named DsNcDiag.dll that is launched using the DLL side-loading technique. The legitimate executable file with digital signature and original name nclauncher.exe from the software package Pulse Secure Network Connect 8.3 is used as a loader.
Information	<https://securelist.com/toddycat-keep-calm-and-check-logs/110696/>

Last change to this tool card: 23 April 2024

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups