Longhorn__2020__Longhorn_Tools_used_by_cyberespionage_group_linked_to_Vault_7.pdf

Symantec details the activity of Longhorn, an advanced espionage group linked to Vault 7, describing its use of multiple custom backdoors (Corentry, Plexor, LH1, LH2), zero-day exploits, and Vault 7-derived tradecraft (custom crypto, in-memory obfuscation, RTP C2 techniques). The report correlates malware samples and compilation metadata to Vault 7 changelogs, catalogs target-specific indicators (codewords, domains, sample hashes), and characterizes Longhorn as a well-resourced, likely state-affiliated operator conducting targeted intelligence-gathering across governments and critical sectors.