S0532: Lucifer
Analyst context for executives and security teams
Lucifer matters because ATT&CK describes it as Windows malware combining cryptomining with DDoS capability and lateral spread through well-known exploits. For leaders, the practical risk is not just malware cleanup: it can consume compute, degrade services, move across Windows environments, and create incident-response pressure where vulnerability management, endpoint visibility, SMB/WMI controls, and log retention are weak.
Executive priority
Prioritize Lucifer-style behavior as a resilience and control-validation issue for Windows environments. Ask whether critical Windows systems are patched against known remote-service vulnerabilities, whether lateral movement over SMB and WMI is monitored, whether abnormal compute/network consumption would trigger response, and whether Windows event logs are protected from clearing. This object has no official ATT&CK detection guidance, so confidence should come from local telemetry validation, not from assuming named-malware coverage.
Technical view
SOC and IR teams should validate coverage across the related ATT&CK behaviors: discovery of registry, users, processes, system/network configuration, services, and connections; execution via Windows command shell and WMI; persistence through Scheduled Tasks and Registry Run Keys/Startup Folder; lateral movement and transfer via SMB/Windows Admin Shares, exploitation of remote services, and lateral tool transfer; command-and-control using application-layer protocols and symmetric cryptography; defense impairment through Windows event log clearing; and impact patterns consistent with compute hijacking and network DoS. Because the malware object is Windows-scoped and detection text is not provided, detections should be behavior-led and correlated rather than dependent on a single signature.
Likely telemetry
- Windows process creation and command-line telemetry, especially cmd.exe, schtasks, reg, WMI-related execution, discovery commands, and file transfer utilities
- Windows Registry auditing for Run Keys, startup persistence, and registry queries where available
- Scheduled Task creation, modification, and execution events
- WMI activity, including local and remote execution indicators
- SMB and Windows Admin Share access logs, file copy events, and authentication records
Detection direction
- Build detections around sequences: discovery commands followed by tool transfer, SMB/WMI execution, persistence creation, and abnormal compute or network usage.
- Tune for administrative false positives by baselining legitimate WMI, scheduled task, registry, SMB admin share, and service-discovery activity by host role and admin identity.
- Correlate password guessing and failed authentication patterns with subsequent SMB or remote-service access attempts where telemetry exists.
- Validate that event-log clearing is detected quickly and that downstream logging preserves evidence when endpoint logs are deleted.
- Account for software packing and deobfuscation by combining static file signals with runtime behavior, child processes, network activity, and persistence artifacts.
Mitigation priorities
- Maintain a vulnerability-management priority lane for high-risk Windows remote services and externally or broadly reachable internal services.
- Restrict and monitor SMB/Windows Admin Shares and WMI remote execution to approved administrative paths and identities.
- Harden credential controls against password guessing, including account policy, monitoring, and response workflows appropriate to the environment.
- Limit unnecessary lateral movement paths through segmentation and least-privilege administration.
- Control persistence opportunities by monitoring and governing Scheduled Tasks, Registry Run Keys, and startup locations.
Analyst notes and limits
The strongest decision value from this ATT&CK object is the combination of Windows malware, exploitation-enabled spread, discovery-heavy behavior, persistence, lateral movement, command-and-control, compute hijacking, and network DoS-related impact. This supports a control validation exercise across endpoint, identity, network, vulnerability management, and incident response rather than a narrow malware-family lookup.
The supplied ATT&CK object does not provide official detection guidance, aliases, labels, or malware-level tactics. Several related techniques list broader platforms, but the Lucifer malware object itself is scoped to Windows; do not infer Lucifer coverage on other platforms from those relationships alone. Local environment evidence is required to determine exposure, detection coverage, and prioritization.
Lucifer
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 13c892239ec1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Unit 42 Lucifer June 2020
Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
Open source URL -
[2]
mitre-attack S0532Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.