 |
สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์ Electronic Transactions Development Agency |
|
สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์ Electronic Transactions Development Agency |
Tool: LightNeuron| Names | LightNeuron NETTRANS XTRANS | |
| Category | Malware | |
| Type | Info stealer | |
| Description | (ESET) Turla is believed to have used LightNeuron since at least 2014. • LightNeuron is the first publicly known malware to use a malicious Microsoft Exchange Transport Agent. • LightNeuron can spy on all emails going through the compromised mail server. • LightNeuron can modify or block any email going through the compromised mail server. • LightNeuron can execute commands sent by email. • Commands are hidden in specially crafted PDF or JPG attachments using steganography. • LightNeuron is hard to detect at the network level because it does not use standard HTTP(S) communications. | |
| Information | <https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf> | |
| MITRE ATT&CK | <https://attack.mitre.org/software/S0395/> | |
| Malpedia | <https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron> | |
Last change to this tool card: 22 April 2020
Download this tool card in JSON format
| Changed | Name | Country | Observed | ||
APT groups | |||||
| Turla, Waterbug, Venomous Bear |  | 1996-Dec 2023 | |||
1 group listed (1 APT, 0 other, 0 unknown)
|
Digital Service Security Center Follow us on
|
Report incidents |
|
 |
+66 (0)2-123-1227 | |
 |
[email protected] | |