MalwareUsed by 1 actor

LIDSHOT

LIDSHOT is a malware family associated with the UNC2970 threat cluster, which Mandiant linked to TEMP.Hermit. It is part of a broader UNC2970 toolset that includes PLANKWALK, LIDSHIFT, TOUCHSHIFT, TOUCHSHOT, TOUCHKEY, HOOKSHOT, TOUCHMOVE, SIDESHOW, and CLOUDBURST. UNC2970 has been reported targeting the defense, media, and technology sectors, and Mandiant assessed the group may have expanded targeting to include security researchers.

The provided content identifies LIDSHOT as an implant with dedicated detection content, including YARA rules and IOC signatures, and references LIDSHOT command-and-control infrastructure. One described infection chain states that a preceding component injects a DLL disguised as a Notepad++ plugin and then loads LIDSHOT. In that context, the preceding malware is described as a downloader capable of system enumeration and deployment of additional malicious payloads on the compromised host.

High-confidence indicators directly provided for LIDSHOT include the file hash 41dcd8db4371574453561251701107bc. The content also notes the existence of LIDSHOT C2-related detections, but does not provide a specific LIDSHOT C2 URL in the supplied material. Overall, LIDSHOT should be understood as part of an actively developed UNC2970 malware ecosystem used in intrusion activity against enterprise targets.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

IOC Signature ... LIDSHOT ... LIDSHOT C2 ... LIDSHOT rule ... "Detects LIDSHOT implant"

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

Multiple C2 URLs listed for PLANKWALK/LIDSHOT/SIDESHOW/CLOUDBURST and “Command and Control - QUESTDOWN…” validation actions.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

picus security blogNews

Feb 23, 2022

MITRE ATT&CK T1055 Process Injection

LidShot is a downloader malware that performs system enumeration and deploys additional malicious payloads on compromised systems, often loaded by LidShift.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

LIDSHOT