Loading malware…
LionTail is a sophisticated in-memory malware framework consisting of custom loaders and memory-resident shellcode implants. The provided content states that it abuses undocumented behavior in the Windows HTTP.sys driver to covertly deliver and retrieve payloads via inbound HTTP traffic. Kaspersky reported detecting LionTail in memory on several critical Windows servers, including within the legitimate WMI host process scrcons.exe located at C:\Windows\System32\wbem. The framework was associated in the content with long-term, low-visibility access and stealthy persistence, and was described alongside related tooling such as TEMPLEDOOR, SASHEYAWAY, and a repurposed Windows kernel driver. The activity was linked in the content to Scarred Manticore, and separately described as used by OilRig during an eight-month intrusion against undisclosed Middle Eastern government entities in 2023. Additional tradecraft mentioned with the associated operations includes DNS tunneling, HTTP communications, scheduled tasks, macros, and PowerShell scripts, as well as deployment of PowerShell backdoors and keyloggers. High-confidence indicators directly mentioned for LionTail include its in-memory presence in scrcons.exe and its use of covert inbound HTTP traffic via HTTP.sys on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...была выявлена устойчивая угроза... связана с фреймворком LionTail — сложным набором кастомных загрузчиков и резидентных имплантов на основе шелл-кода.
...including the LionTail framework, TEMPLEDOOR, SASHEYAWAY, and a repurposed Windows kernel driver... designed to sustain long-term, low-visibility access.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
This may indicate that the attacker exploited a vulnerability in the web application to gain remote code execution, allowing them to establish a reliable command and control channel that bypassed the firewall because it was initiated from inside the network.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Сложный фреймворк из кастомных загрузчиков и резидентных имплантов, работающих в памяти; использует особенности HTTP.sys для скрытой доставки полезной нагрузки через HTTP-трафик.
A sophisticated in-memory framework of custom loaders and shellcode implants that abuses undocumented HTTP.sys behavior to covertly deliver/retrieve payloads over inbound HTTP and blend malicious traffic into legitimate flows.
ShroudedSnooper framework for passive backdoors and web shells enabling long-term stealthy access.
Custom loader and memory-resident shellcode framework used by OilRig for advanced evasion and payload delivery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.