LunarWeb

Malware & Tools · LunarWeb

· MalwareS1141 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.(Citation: ESET Turla Lunar toolset May 2024)

Tactic Coverage

discovery (12)command and control (8)stealth (4)execution (4)collection (2)exfiltration (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (30)

T1001.002Steganography

command and control

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1030Data Transfer Size Limits

exfiltration

T1033System Owner/User Discovery

discovery

T1047Windows Management Instrumentation

execution

T1049System Network Connections Discovery

References

https://attack.mitre.org/software/S1141 https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1069.001Local Groups

discovery

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090Proxy

command and control

T1104Multi-Stage Channels

command and control

T1132.001Standard Encoding

command and control

T1135Network Share Discovery

discovery

T1140Deobfuscate/Decode Files or Information

stealth

T1497.003Time Based Checks

stealthdiscovery

T1518Software Discovery

discovery

T1518.001Security Software Discovery

discovery

T1559Inter-Process Communication

execution

T1560.001Archive via Utility

collection

T1560.002Archive via Library

collection

T1572Protocol Tunneling

command and control

T1573.001Symmetric Cryptography

command and control

T1573.002Asymmetric Cryptography

command and control

T1615Group Policy Discovery

discovery