LIGHTRAIL
- ID
- S9061
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 2 Oct 2026
LIGHTRAIL is a tunneler malware.[1] LIGHTRAIL has been known to communicate with C2 SOCKS4A Websocket communications.[1] LIGHTRAIL was first observed in 2022. LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1][2]
Techniques used (7)
- T1001.003 Protocol or Service Impersonation
- T1036.012 Browser Fingerprint
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1106 Native API
- T1572 Protocol Tunneling
- T1574.001 DLL