Loading malware…
Lemon Tree is an offensive framework that Proofpoint identified as being used by cybercrime actors as a first-stage payload. In the provided reporting, it is mentioned alongside Veil as part of a broader trend of cybercriminal adoption of legitimate or offensive security frameworks. The surrounding context ties this trend to campaigns by TA551 (also known as Shathak), an initial access facilitator known for email-based malware delivery and follow-on ransomware enablement, but the provided content does not directly attribute Lemon Tree to TA551 specifically. No additional high-confidence details on Lemon Tree’s internal capabilities, infection chain, targeted platforms, industries, or specific indicators of compromise are provided in the content beyond its use as a first-stage payload by cybercrime actors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Offensive framework mentioned as being used by cybercrime actors as a first-stage payload (no further detail provided).
Offensive/red team framework mentioned as being used as a first-stage payload by cybercrime actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.