Skip to main content
Mallory

L0pht

Also known asL0pht

L0pht was a Boston-area hacker collective, described in the content as a suburban Boston group of eight hackers and publicly characterized as a "hacker think tank." The group conducted security research on commercial software and network systems, maintained a warehouse workshop with more than 200 computers, and used internal dummy networks to test and break into its own systems to identify flaws. When L0pht found vulnerabilities in commercial network software, it published advisories on its website that included both exploit details and mitigation guidance for administrators. The content describes this disclosure model as controversial because it could aid both defenders and malicious hackers. The content identifies members by the screen names Dr. Mudge, Space Rogue, Dildog, Brian Oblivion, Kingpin, Silicosis, Weld Pond, and John Tan. Silicosis is described as the newest member and demonstrated a technique affecting Windows 95, Windows 98, and Windows 2000 systems that could disconnect targeted computers from the internet and potentially reroute nearby users’ traffic, enabling theft of banking transactions, passwords, or credit-card information. L0pht also had a public policy profile. The group appeared before the United States Senate Committee on Governmental Affairs, where Senator Fred Thompson introduced it as a hacker think tank and the group presented security weaknesses in public and private systems. The content states that Senator Joe Lieberman and Senator Fred Thompson praised L0pht’s work, and National Security Council official Jeffrey Hunker described the group as part of a community of "white-hatted hackers" whose objective was to identify vulnerable products and help ensure the vulnerabilities were fixed. Known alias in the content: l0pht / L0pht.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

4 of 15 tactics5 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0001
Initial Access
1 technique
T1190
Exploit Public-Facing Application
TA0006
Credential Access
2 techniques
T1212
Exploitation for Credential Access
T1557
Adversary-in-the-Middle
TA0009
Collection
1 technique
T1557
Adversary-in-the-Middle
TA0040
Impact
1 technique
T1498
Network Denial of Service
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping4

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

L0pht | Mallory