Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 15:28:21 UTC
Home > List all groups > List all tools > List all groups using tool LIGHTSHOW
 Tool: LIGHTSHOW
Names
LIGHTSHOW
FudModule
Category Malware
Type Poisoning
Description
(Mandiant) LIGHTSHOW is a utility that was used by UNC2970 to manipulate kernel data-structures and represents an advancement in DPRK’s capabilities to evade detection.
Information <https://www.mandiant.com/resources/blog/lightshift-and-lightshow>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule>
Last change to this tool card: 13 October 2023
Download this tool card in JSON format
All groups using tool LIGHTSHOW
Changed Name Country Observed
APT groups
  Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c28d6028-a6c9-4eba-acfb-62579e176b64
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c28d6028-a6c9-4eba-acfb-62579e176b64
Page 1 of 1