Researcher dissects CIA's OSX.GreenLambert implant
A deep-dive technical analysis reverse-engineers the CIA-linked Green Lambert (GrowlHelper) macOS implant tied to the Vault 7 leak and The Lamberts/Longhorn actor.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Objective-See blog post presents a detailed static and dynamic analysis of OSX.GreenLambert (also known as GrowlHelper), a macOS implant attributed to the threat actor tracked by Symantec as Longhorn and by Kaspersky as The Lamberts. The implant is linked to the CIA's hacking toolkit exposed in the 2017 Vault 7 WikiLeaks disclosure. The analysis covers persistence mechanisms (LaunchAgents, LoginItems, shell profile hijacking), encrypted string handling, command-line argument discovery, and network communication with a hardcoded C2 domain and IP address, revealing tradecraft consistent with CIA development guidelines also leaked via Vault 7.
The researcher determined the implant is a 32-bit Mach-O executable targeting OS X 10.7 (Lion) and later, likely developed and used between 2007 and 2013 based on library versions and API usage. It communicates with a "Listening Post" (the actor's term for C2 infrastructure) via login.php, getconf.php, and getfile.php, using the hardcoded domain notify.growlupdate[.]com and IP 94.242.252[.]68, which Kaspersky later sinkholed. Analysis of encrypted strings, entry-point structure, and adherence to CIA development tradecraft guidelines (file size, C2 jitter, secure erase, encrypted logs) provides insight into the sophistication and terminology used by this long-running threat actor.
Historically, Symantec reported that Longhorn/The Lamberts has targeted governments and organizations in financial, telecom, energy, aerospace, IT, education, and natural resources sectors, while QI-ANXIN noted targeting of personnel and institutions in China. The actor's toolkit reportedly includes network-driven backdoors, modular backdoors, harvesting tools, and wipers, with Green Lambert described as the oldest and longest-running implant in the family, and newer variants (e.g., Purple Lambert) continuing to surface as recently as 2021.
Mentioned in this report
Detection guidance
3 detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x68.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs