Malware.View on attack.mitre.org
LightNeuron is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. LightNeuron has been used by Turla to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of LightNeuron exists.
| Technique | Procedure example |
|---|---|
| T1001.002 Steganography |
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods. |
| T1005 Data from Local System |
LightNeuron can collect files from a local system. |
| T1016 System Network Configuration Discovery |
LightNeuron gathers information about network adapters using the Win32 API call |
| T1020 Automated Exfiltration |
LightNeuron can be configured to automatically exfiltrate files under a specified directory. |
| T1027.013 Encrypted/Encoded File |
LightNeuron encrypts its configuration files with AES-256. |
| T1029 Scheduled Transfer |
LightNeuron can be configured to exfiltrate data during nighttime or working hours. |
| T1036.005 Match Legitimate Resource Name or Location |
LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as |
| T1041 Exfiltration Over C2 Channel |
LightNeuron exfiltrates data over its email C2 channel. |
| T1059.003 Windows Command Shell |
LightNeuron is capable of executing commands via cmd.exe. |
| T1070.004 File Deletion |
LightNeuron has a function to delete files. |
| T1071.003 Mail Protocols |
LightNeuron uses SMTP for C2. |
| T1074.001 Local Data Staging |
LightNeuron can store email data in files and directories specified in its configuration, such as |
| T1082 System Information Discovery |
LightNeuron gathers the victim computer name using the Win32 API call |
| T1105 Ingress Tool Transfer |
LightNeuron has the ability to download and execute additional files. |
| T1106 Native API |
LightNeuron is capable of starting a process using CreateProcess. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
