LookBack

LookBack is a remote access trojan written in C++ that was used against at least three US utility companies in July 2019. The TALONITE activity group has been observed using LookBack.

View graph Watch Export

Indicators tracked

Intelligence Reports30

30 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

22 relationships

T1113: Screen Capture

source

T1036.005: Match Legitimate Resource Name or Location

source

T1489: Service Stop

source

T1573.001: Symmetric Cryptography

source

T1574.001: DLL

source

T1007: System Service Discovery

source

T1140: Deobfuscate/Decode Files or Information

source

T1083: File and Directory Discovery

source

T1057: Process Discovery

source

T1547.001: Registry Run Keys / Startup Folder

source

T1095: Non-Application Layer Protocol

source

T1059.003: Windows Command Shell

source

T1070.004: File Deletion

source

T1071.001: Web Protocols

source

T1059.005: Visual Basic

source

T1529: System Shutdown/Reboot

source