L0pht
L0pht was a Boston-area hacker collective, described in the content as a suburban Boston group of eight hackers and publicly characterized as a "hacker think tank." The group conducted security research on commercial software and network systems, maintained a warehouse workshop with more than 200 computers, and used internal dummy networks to test and break into its own systems to identify flaws. When L0pht found vulnerabilities in commercial network software, it published advisories on its website that included both exploit details and mitigation guidance for administrators. The content describes this disclosure model as controversial because it could aid both defenders and malicious hackers. The content identifies members by the screen names Dr. Mudge, Space Rogue, Dildog, Brian Oblivion, Kingpin, Silicosis, Weld Pond, and John Tan. Silicosis is described as the newest member and demonstrated a technique affecting Windows 95, Windows 98, and Windows 2000 systems that could disconnect targeted computers from the internet and potentially reroute nearby users’ traffic, enabling theft of banking transactions, passwords, or credit-card information. L0pht also had a public policy profile. The group appeared before the United States Senate Committee on Governmental Affairs, where Senator Fred Thompson introduced it as a hacker think tank and the group presented security weaknesses in public and private systems. The content states that Senator Joe Lieberman and Senator Fred Thompson praised L0pht’s work, and National Security Council official Jeffrey Hunker described the group as part of a community of "white-hatted hackers" whose objective was to identify vulnerable products and help ensure the vulnerabilities were fixed. Known alias in the content: l0pht / L0pht.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a named hacking group in the historical timeline/navigation content.
Named hacking group listed in the content's 1990s timeline/navigation material.
Named as a hacking group in a 1990s hacking timeline/sidebar; no specific operations, malware use, or targeting details are provided in the content.
Referenced only as a named hacking group in a navigational list; no operational details are provided in the content.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.