Why LaZagne Makes D-Bus API Vigilance Crucial
Summary: Unit 42 reports that attackers are increasing targeted attacks on Linux systems and using the open-source hacktool LaZagne, which connects to Pidgin's D-Bus APIs to dump account usernames and passwords while the application runs, and can also dump KWallet passwords via D-Bus. The article ties LaZagne to campaigns by Agent Serpens in 2019, CL-CRI-0025/UNC1945 in 2020, Prying Libra since 2020, and Adept Libra's Chimaera campaign from July 2021 through at least December 2021, and notes that eBPF-based tools such as bpftrace can log D-Bus API calls to detect the activity.
Why it matters: LaZagne pulls credentials from a running chat client through D-Bus, an inter-process communication channel used by NetworkManager, PulseAudio, systemd and Evolution, so the same mechanism that moves data between your Linux components can hand passwords to a hacktool. Groups tracked as Agent Serpens, UNC1945 and TeamTNT have already used it in real campaigns, which puts the question to your Linux and cloud estate rather than to someone else's.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026