MITRE ATT&CKsoftware (malware)
S0690 Green Lambert
- Domain
- enterprise
- Platforms
- Windows, iOS, macOS, Linux
- Version
- 1.0
- Created
- 2022-03-21
Description
Green Lambert is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of Green Lambert may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.
Related
Uses · MITRE ATT&CK (18)
- T1547.015 Login Items sub-technique
- T1071.004 DNS sub-technique
- T1059.004 Unix Shell sub-technique
- T1555.001 Keychain sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1546.004 Unix Shell Configuration Modification sub-technique
- T1543.001 Launch Agent sub-technique
- T1543.004 Launch Daemon sub-technique
- T1037.004 RC Scripts sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1082 System Information Discovery technique
- T1090 Proxy technique
- T1124 System Time Discovery technique
References
- https://securelist.com/unraveling-the-lamberts-toolkit/77990/ Kaspersky Lamberts Toolkit April 2017
- https://objective-see.com/blog/blog_0x68.html Objective See Green Lambert for OSX Oct 2021