S0690 Green Lambert

malwareEnterprise

platformsWindows · iOS · macOS · Linux

also known asGreen Lambert

Green Lambert is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of Green Lambert may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1036.004Masquerade Task or Service
T1036.005Match Legitimate Resource Name or Location
T1037.004RC Scripts
T1059.004Unix Shell
T1070.004File Deletion
T1071.004DNS
T1082System Information Discovery
T1090Proxy
T1124System Time Discovery
T1140Deobfuscate/Decode Files or Information
T1543.001Launch Agent
T1543.004Launch Daemon
T1546.004Unix Shell Configuration Modification
T1547.015Login Items
T1555.001Keychain

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan