← Remote Workers

lapwiz/Windows-LAPS

lapwiz/Windows-LAPS is a malicious repository that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The reports are dated 2026-04-14.

malicious repository EtherHiding / UNC5342DPRK (cluster unattributed) CURATED Taken down checked 2026-10-05

First seen 2026-04-14 · last seen 2026-04-14

Sources

• GitHub facade repository Atos lists as spoofing Windows LAPS to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.

  EtherRAT-appendixes (IoCs/malicious_github_repos.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• GitHub facade repository Atos lists as spoofing Windows LAPS to distribute EtherRAT: a search-optimized repository whose README points to a payload held on a secondary account that can be rotated. Atos names no actor of its own; it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling, so the entry carries the unattributed DPRK label. Not verified by this site to be live or removed.

  EtherRAT distribution: spoofing administrative tools via GitHub facades — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every malicious repository this site holds under Malicious repositories in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/malicious_github_repos.csv)

Atos Threat Research Center lists 96 other indicators in this source. 7 are shown, chosen across types.

• 135.125.255.55 IP address
• 91.221.190.12 IP address
• migrtool/PCmover malicious repository
• 0x123f12517f1643f0a8897776989f8d440aa76764 smart contract address
• 0xf1f3ac96e49f6a71d031444e59268c27b3511914 smart contract address
• 0x14afddd627fb0e039365554f8bbdb881ecb1c708 cryptocurrency wallet address
• 0xf3947eeb5db984e9498da449c13305ed27428bc0 cryptocurrency wallet address

All 97 indicators from this source

Cited by the same report: EtherRAT distribution: spoofing administrative tools via GitHub facades

Atos Threat Research Center lists 44 other indicators in this source. 5 are shown, chosen across types.

• paperdesk/PaperPort malicious repository
• procbyte/ProcDump malicious repository
• prtgmon/PRTG-Network-Monitor malicious repository
• 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 smart contract address
• 0x37ef6e88425613564b2cf8adc496acff4b6481a9 cryptocurrency wallet address

All 45 indicators from this source