Loading malware…
Gray Lambert is a highly sophisticated passive network-driven backdoor within the Lambert espionage toolkit, also associated with the Longhorn cluster. It is regarded as the latest known iteration of the toolkit’s passive listener capability and is closely related to White Lambert, mirroring its covert command reception model while operating in user mode rather than kernel mode. This design avoids the need for signed-driver abuse previously used by White Lambert to execute unsigned kernel code on 64-bit Windows systems.
The malware is intended for stealthy post-compromise control. Rather than beaconing in a conventional manner, it passively monitors network traffic for specially crafted packets carrying operator instructions, making it a NOBUS-style implant optimized for covert access on already-compromised systems. Reported functionality includes orchestrating multiple sniffer victims through broadcast, multicast, and unicast command mechanisms. Gray Lambert has been observed on systems previously infected with White Lambert, indicating an operational migration from the older passive implant to this newer user-mode variant; such migration activity was still observed in 2016.
Gray Lambert is part of a broader multi-family cyber-espionage framework that includes Black, White, Blue, Green, and Pink Lambert components spanning active implants, passive backdoors, harvesting tools, and orchestration modules. The Lambert ecosystem has been linked through shared code, data formats, infrastructure patterns, and overlapping victimology, and has been assessed as comparable in sophistication to top-tier espionage platforms such as Regin, ProjectSauron, Equation, and Duqu2. Reported victimology for Gray Lambert emphasizes strategic targets in Asia and the Middle East. High-confidence platform evidence supports Windows targeting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gray Lambert is the latest iteration of the passive network tools from the Lamberts’ arsenal... It is a network-driven backdoor, similar in functionality to White Lambert.
Gray Lambert is the latest iteration of the passive network tools from the Lamberts’ arsenal... It is a network-driven backdoor, similar in functionality to White Lambert.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced Lambert-family user-mode passive listener; discussed comparatively as similar in concept to Purple Lambert and as a replacement chain involving White Lambert.
Advanced user-land passive implant that can coordinate network sniffers and also act as a next-stage payload delivery mechanism; targets strategic verticals in Asia and the Middle East.
The newest known passive network backdoor in the Lamberts toolkit. Unlike White Lambert, it runs in user mode and appears to have been used to upgrade earlier White Lambert infections.
A newer network-driven backdoor/implant functionally similar to White Lambert but running in user mode (no kernel driver exploit required). Seen on systems previously infected with White Lambert, suggesting an upgrade/migration path; last observed migration activity in October 2016.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.