LookBack

ATP Sandbox Adv. HeuristicsNetskope IPS

Description

LookBack is a C++ remote access trojan used against at least three US utility companies in July 2019, with the TALONITE activity group observed deploying it.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

Lookback

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.005Visual Basic

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

TA0007 Discovery

T1007System Service Discovery
T1057Process Discovery
T1083File and Directory Discovery

TA0009 Collection

T1113Screen Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1095Non-Application Layer Protocol
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0040 Impact

T1489Service Stop
T1529System Shutdown/Reboot

Alert name variants

Alert Name	Engine
Document-Word.Backdoor.LookBack	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Lookback	ATP Sandbox Adv. Heuristics
Win32.Backdoor.LookBack	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Generic.Lookback.malware.c2 traffic detected	IPS-SWG

Related families

InvisiMole Metamorfo PlugX Bisonal QakBot

References