[LIGHTRAIL](https://attack.mitre.org/software/S9061) is a tunneler malware.(Citation: Mandiant_UNC1549_Feb2024) [LIGHTRAIL](https://attack.mitre.org/software/S9061) has been known to communicate with C2 SOCKS4A Websocket communications.(Citation: Mandiant_UNC1549_Feb2024) [LIGHTRAIL](https://attack.mitre.org/software/S9061) was first observed in 2022. [LIGHTRAIL](https://attack.mitre.org/software/S9061) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025)