Exploit / PoCcritical
Unraveling the Lamberts Toolkit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-4148 | Kernel-Mode Remote Code Execution in Microsoft Windows via TrueType Font Handling | — | 60% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.0.0.2 | CK (2.3.0.2), FUNNELCAKE CARNIVAL (2.5.0.2), PROSPER SPOCK (2.0.0.2), RINGTOSS CARNIVAL (2.4.2.2), COD FISH (2.2.0.0), and INVE |
| ipv4 | 2.2.0.2 | ting internal codenames Known codenames include TRUE CRIME (2.2.0.2), CERVELO YARDBIRD (2.6.1.1), GAI SHU (2.2.0.5), DOUBLESIDE |
| ipv4 | 2.2.0.5 | TRUE CRIME (2.2.0.2), CERVELO YARDBIRD (2.6.1.1), GAI SHU (2.2.0.5), DOUBLESIDED SCOOBYSNACK (2.3.0.2), FUNNELCAKE CARNIVAL (2 |
| ipv4 | 2.3.0.2 | BIRD (2.6.1.1), GAI SHU (2.2.0.5), DOUBLESIDED SCOOBYSNACK (2.3.0.2), FUNNELCAKE CARNIVAL (2.5.0.2), PROSPER SPOCK (2.0.0.2), R |
| ipv4 | 2.4.2.2 | IVAL (2.5.0.2), PROSPER SPOCK (2.0.0.2), RINGTOSS CARNIVAL (2.4.2.2), COD FISH (2.2.0.0), and INVERTED SHOT (2.6.2.3). Green La |
| ipv4 | 2.5.0.2 | 5), DOUBLESIDED SCOOBYSNACK (2.3.0.2), FUNNELCAKE CARNIVAL (2.5.0.2), PROSPER SPOCK (2.0.0.2), RINGTOSS CARNIVAL (2.4.2.2), COD |
| ipv4 | 2.6.1.1 | n codenames include TRUE CRIME (2.2.0.2), CERVELO YARDBIRD (2.6.1.1), GAI SHU (2.2.0.5), DOUBLESIDED SCOOBYSNACK (2.3.0.2), FUN |
| ipv4 | 2.6.2.3 | CARNIVAL (2.4.2.2), COD FISH (2.2.0.0), and INVERTED SHOT (2.6.2.3). Green Lambert Green Lambert is a family of tools deeply r |
| md5 | 683afdef710bf3c96d42e6d9e7275130 | =wl , build=132914 , versionName = 2.0.0 . Hash Description 683afdef710bf3c96d42e6d9e7275130 generic loader (hdmsvc.exe) 79e263f78e69110c09642bbb30f09ac |
| md5 | 79e263f78e69110c09642bbb30f09ace | 83afdef710bf3c96d42e6d9e7275130 generic loader (hdmsvc.exe) 79e263f78e69110c09642bbb30f09ace winlib.dll, final payload (toolType=wl) Blue Lambert The Bl |
From the original article
12 min read at securelist.com
Yesterday, our colleagues from Symantec published their analysis of Longhorn , an advanced threat actor that can be easily compared with Regin, ProjectSauron, Equation or Duqu2 in terms of its complexity.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.