Threat intelligence / Malware

LightNeuron

[LightNeuron](https://attack.mitre.org/software/S0395) is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. [LightNeuron](https://attack.mitre.org/software/S0395) has been used by [Turla](https://attack.mitre.org/groups/G0010) to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of [LightNeuron](https://attack.mitre.org/software/S0395) exists.(Citation: ESET LightNeuron May 2019)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LightNeuron](https://attack.mitre.org/software/S0395) is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. [LightNeuron](https://attack.mitre.org/software/S0395) has been used by [Turla](https://attack.mitre.org/groups/G0010) to target diplomatic and foreign affairs-related organizations. The presence of certain strings in the malware suggests a Linux variant of [LightNeuron](https://attack.mitre.org/software/S0395) exists.(Citation: ESET LightNeuron May 2019)

Labels

malware

23 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to Mail Protocols

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Remote Email Collection

Technique

uses

to Scheduled Transfer

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Transmitted Data Manipulation

Technique

uses

to Transport Agent

Technique

uses

to Windows Command Shell

Technique

uses

from Turla

Group

2 external

References

mitre-attack

S0395

ESET LightNeuron May 2019

https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf