LightNeuron

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[LightNeuron](https://attack.mitre.org/software/S0395) is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. [LightNeuron](https://attack.mitre.org/software/S0395) has been used by [Turla](https://attack.mitre.org/groups/G0010) to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of [LightNeuron](https://attack.mitre.org/software/S0395) exists.(Citation: ESET LightNeuron May 2019)

Associated Techniques (22)
ID ATT&CK Tactics
T1001.002 Steganography -
T1005 Data from Local System -
T1016 System Network Configuration Discovery -
T1020 Automated Exfiltration -
T1027.013 Encrypted/Encoded File -
T1029 Scheduled Transfer -
T1036.005 Match Legitimate Resource Name or Location -
T1041 Exfiltration Over C2 Channel -
T1059.003 Windows Command Shell -
T1070.004 File Deletion -
T1071.003 Mail Protocols -
T1074.001 Local Data Staging -
T1082 System Information Discovery -
T1105 Ingress Tool Transfer -
T1106 Native API -
Used by Actors (1)
Metadata
ID: 315
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00