H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Green Lambert

[Green Lambert](https://attack.mitre.org/software/S0690) is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of [Green Lambert](https://attack.mitre.org/software/S0690) may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.(Citation: Kaspersky Lamberts Toolkit April 2017)(Citation: Objective See Green Lambert for OSX Oct 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Green Lambert](https://attack.mitre.org/software/S0690) is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of [Green Lambert](https://attack.mitre.org/software/S0690) may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.(Citation: Kaspersky Lamberts Toolkit April 2017)(Citation: Objective See Green Lambert for OSX Oct 2021)

Labels

malware
18 recorded

Relationships

uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DNS
Technique
uses
to File Deletion
Technique
uses
to Keychain
Technique
uses
to Launch Agent
Technique
uses
to Launch Daemon
Technique
uses
to Login Items
Technique
uses
to Masquerade Task or Service
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Proxy
Technique
uses
to RC Scripts
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Time Discovery
Technique
uses
to Unix Shell
Technique
uses
to Unix Shell Configuration Modification
Technique
4 external

References

mitre-attack
S0690
open
Green Lambert
—
Kaspersky Lamberts Toolkit April 2017
https://securelist.com/unraveling-the-lamberts-toolkit/77990/
open
Objective See Green Lambert for OSX Oct 2021
https://objective-see.com/blog/blog_0x68.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance