LunarMail

Malware & Tools · LunarMail

· MalwareS1142 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

LunarMail is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) in conjunction with LunarLoader and LunarWeb. LunarMail is designed to be deployed on workstations and can use email messages and Steganography in command and control.(Citation: ESET Turla Lunar toolset May 2024)

Tactic Coverage

stealth (4)command and control (3)collection (3)execution (2)discovery (2)persistence (2)exfiltration (1)privilege escalation (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (17)

T1001.002Steganography

command and control

T1027.013Encrypted/Encoded File

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1059.005Visual Basic

execution

T1070.004File Deletion

stealth

T1070.008Clear Mailbox Data

stealth

T1071.003Mail Protocols

References

https://attack.mitre.org/software/S1142 https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/