Skip to content
The Wire updated 01:30 UTC Saturday 14 November 2026

Original malware and infrastructure research, with the detections and indicators to act on it. Free, no paywall.

THE HUNTER’S LEDGER
exploit

GodPotato

A public Windows privilege-escalation tool in the Potato line that turns a service account's impersonation right into SYSTEM. Named by 5 reports, 1 detection rule, 4 IOC feeds.
FAMILY GodPotato
5Reportsname this family 1Detection ruleacross 1 detection page 4IOC feedscarry the family field
0Tracked actorsnone

← All families

Reports

5 reports
ReportNov 2026
An AI Pentest Platform Drives Commodity Tooling Against Portuguese Government Targets
Detection rulesIOC feedSTIX bundle
ReportSep 2026
Sliver C2 Windows Post-Exploitation Staging, 193[.]233[.]202[.]17
Detection rulesIOC feedSTIX bundle
ReportJun 2026
Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host
Detection rulesIOC feedSTIX bundle
ReportApr 2026
AdaptixC2 Open Directory Exposure (45[.]130[.]148[.]125)
Detection rulesIOC feedSTIX bundle
ReportApr 2026
Chaos Ransomware (TorBrowserTor) Multi-Stage Loader (94[.]103[.]1[.]13)
Detection rulesIOC feedSTIX bundle

Detection rules

1 rule

YARA rules whose family metadata names this family, by detection page.

Detection rules An AI Pentest Platform Drives Commodity Tooling Against Portuguese Government Targets Nov 2026 · 1 rule · family = GodPotato
HKTL_GodPotato_Lineage_Wide_Strings

IOC feeds

4 feeds
IOC feedJun 2026 · family = GodPotato
Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host
IOC feedApr 2026 · family = GodPotato
Chaos Ransomware (TorBrowserTor) Multi-Stage Loader (94[.]103[.]1[.]13)
IOC feedApr 2026 · family = GodPotato
AdaptixC2 Open Directory Exposure (45[.]130[.]148[.]125)
IOC feedSep 2026 · family = GodPotato
Sliver C2 Windows Post-Exploitation Staging, 193[.]233[.]202[.]17

A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.