LightNeuron

Malware & Tools · LightNeuron

· MalwareS0395 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows, Linux

Description

LightNeuron is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. LightNeuron has been used by Turla to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of LightNeuron exists.(Citation: ESET LightNeuron May 2019)

Tactic Coverage

collection (5)command and control (4)stealth (4)exfiltration (3)discovery (2)execution (2)persistence (1)impact (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (22)

T1001.002Steganography

command and control

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1020Automated Exfiltration

exfiltration

T1027.013Encrypted/Encoded File

stealth

T1029Scheduled Transfer

exfiltration

T1036.005Match Legitimate Resource Name or Location

References

https://attack.mitre.org/software/S0395 https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf