Skip to content

Malware

LucidKnight

According to Cisco Talos, is a companion reconnaissance tool that exfiltrates system information via Gmail.

LucidKnight is a Windows malware family.

Background

Cisco Talos describes it as a supporting reconnaissance utility that siphons system information out through Gmail. Because it appears together with LucidRook, the actor likely runs a layered toolkit, perhaps using LucidKnight to profile victims before moving on to deploy the full stager.


Source: Malpedia (Fraunhofer FKIE).