Loading malware…
LIGHTRAIL is a custom tunneling utility associated with the Iran-aligned espionage actor UNC1549, also tracked as Nimbus Manticore, Mirage Kitten, GalaxyGato, Smoke Sandstorm, and Subtle Snail, with reported overlap to Tortoiseshell. It has been used in long-running cyber-espionage operations targeting aerospace, aviation, defense, telecommunications, government, and related organizations across the Middle East and other regions.
The malware is characterized as a bespoke tunneler likely derived from Lastenzug, an open-source Socks4a proxy, and adapted to communicate through cloud-hosted infrastructure to blend malicious traffic with legitimate services. It has been used to provide covert command-and-control connectivity and to relay operator traffic through victim environments, supporting resilient post-compromise access and stealthy data movement. Reporting also describes LIGHTRAIL as part of a broader tunneling toolkit used alongside other custom tunnelers such as GHOSTLINE and POLLBLEND.
UNC1549 has deployed LIGHTRAIL during post-exploitation and persistence phases, including execution via DLL search-order hijacking against legitimate software. The actor is known for extensive abuse of DLL side-loading and search-order hijacking across multiple malware families, sometimes installing legitimate software specifically to enable this execution method. LIGHTRAIL has also been observed in campaigns that relied on tailored spearphishing and recruitment-themed social engineering to gain access, after which tunneling tools were used to maintain covert connectivity inside victim networks.
Operationally, LIGHTRAIL fits the actor’s emphasis on long-term espionage, stealth, and defense evasion. Its use of cloud-based communications and proxy-style tunneling helps disguise malicious traffic within normal enterprise network activity and supports covert exfiltration and persistent remote access from compromised Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The use of BridgeHead and ArcBridge indicates the threat actor's continued use of tunneling utilities, which has been previously observed relying on bespoke tunnelers such as LIGHTRAIL and POLLBLEND.
This aligns with previous public reporting, which documented the group’s use of the LIGHTRAIL and POLLBLEND tunnelers.
"LIGHTRAIL, a custom tunneler that's likely based on Lastenzug, an open-source Socks4a proxy that communicates using Azure cloud infrastructure"
6 distinct techniques documented for this family, organized by ATT&CK tactic.
"UNC1549 abused DLL search order hijacking to execute CRASHPAD, DCSYNCER.SLICK, GHOSTLINE, LIGHTRAIL, MINIBIKE, POLLBLEND, SIGHTGRAB, and TWOSTROKE payloads... installed the legitimate software after initial access in order to abuse SOH... replaced or added the malicious DLLs within the legitimate installation directory, typically with SYSTEM privileges."
A benign lure in the form of an application like OneDrive (MINIBIKE) or, in the case of MINIBUS, a custom application presenting content related to Israelis kidnapped by Hamas... Using domain naming schemes that include strings that would likely seem legitimate to network defenders.
"UNC1549 abused DLL search order hijacking to execute CRASHPAD, DCSYNCER.SLICK, GHOSTLINE, LIGHTRAIL, MINIBIKE, POLLBLEND, SIGHTGRAB, and TWOSTROKE payloads... installed the legitimate software after initial access in order to abuse SOH... replaced or added the malicious DLLs within the legitimate installation directory, typically with SYSTEM privileges."
Payload installation and device compromise, achieved after the MINIBIKE or MINIBUS backdoors establish C2 communication, in most cases via Microsoft Azure cloud infrastructure.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A bespoke tunneling utility previously used by the threat actor, mentioned as historical background.
A previously reported tunneling utility used by Mirage Kitten, mentioned as part of the group’s historical tunneling tradecraft.
Tortoiseshell malware component used within a modular framework for long-term access and movement.
Tunneling tool used for covert command-and-control and data exfiltration by disguising malicious traffic within legitimate cloud communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.