1. Home
  2. Software
  3. LIGHTRAIL

LIGHTRAIL

LIGHTRAIL is a tunneler malware.[1] LIGHTRAIL has been known to communicate with C2 SOCKS4A Websocket communications.[1] LIGHTRAIL was first observed in 2022. LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1][2]

ID: S9061
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 30 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

LIGHTRAIL has communicated over websockets to cloud C2 infrastructure.[1][2]
Enterprise T1001 .003 Data Obfuscation: Protocol or Service Impersonation

LIGHTRAIL has leveraged hard-coded User Agent strings to blend in with traffic to include Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136.[2][1]
Enterprise T1574 .001 Hijack Execution Flow: DLL

LIGHTRAIL has been deployed using a launcher, which has been executed via search-order-hijacking (SoH).[2]
Enterprise T1036 .012 Masquerading: Browser Fingerprint

LIGHTRAIL has leveraged hard-coded User Agent strings to mimic legitimate browser traffic. [2][1]
Enterprise T1106 Native API

LIGHTRAIL has leveraged Windows API calls to establish the WebSocket to include WinHTTP.[2]

Enterprise T1572 Protocol Tunneling

LIGHTRAIL has used SOCKS4A proxies to tunnel traffic.[1]

Enterprise T1090 .002 Proxy: External Proxy

LIGHTRAIL has utilized SOCKS4A proxies to communicate with the C2.[1][2]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1][2]

References

  1. Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.
  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.