LilithMalware
Lilith is a console-based ultra light-weight RAT developed in C++. It features a straight-forward set of commands that allows for near complete control of a machine.From MISP Galaxy
Last reported 4 days ago, by Security Affairs2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive“Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible.”
-
JSAC2026 -Day 1-“These included the transition from Custom Lilith RAT to GSRAT and distinctive infrastructure operation patterns observed across campaigns.”
Indicators in its reports
named in the reports above- hexane[.]ccin 1 report
Copy this indicator · defanged
Thanks — we review every report.