LunarWeb Backdoor Proves to be Problematic for Affected Computer Users
In recent cybersecurity revelations, an unnamed European Ministry of Foreign Affairs (MFA) and its diplomatic missions in the Middle East have fallen victim to a sophisticated cyberattack involving two novel backdoors: LunarWeb and LunarMail.
Table of Contents
The Turla Connection: A History of Espionage
ESET, a prominent cybersecurity firm, has identified the perpetrators behind the attack with medium confidence, linking it to the Russia-aligned cyberespionage group Turla. Also known by various aliases such as Iron Hunter and Venomous Bear, Turla has a notorious history dating back to 1996, with a penchant for targeting diverse sectors including government, military, and research institutions.
Unraveling the Lunar Artifacts: Tactics and Techniques
Security researcher Filip Jurčacko shed light on the modus operandi of the Lunar backdoors. LunarWeb, deployed on servers, communicates via HTTP(S) and mimics legitimate requests, while LunarMail, installed on workstations, masquerades as an Outlook add-in utilizing email messages for its operations.
The Attack Vector: Insights into the Intrusion
Analysis indicates that the Lunar artifacts have been operational in targeted attacks since early 2020, showcasing the group's persistence and evolving tactics. The attack chain, dissected by ESET, begins with a compiled ASP.NET web page used to decode embedded payloads, including LunarLoader and LunarWeb.
LunarWeb’s Arsenal: A Closer Look
LunarWeb is designed to gather system information, execute commands within image files, and camouflage its network traffic to evade detection. Its capabilities range from running shell commands to archiving files, showcasing its versatility in infiltrating and manipulating targeted systems.
LunarMail: Exploiting Outlook for Espionage
Meanwhile, LunarMail infiltrates systems through malicious Word documents sent via spear-phishing emails. Operating as an Outlook add-in, it communicates with its command-and-control server through email messages, utilizing PNG attachments to conceal its activities.
Conclusion: The Ongoing Threat
The discovery of LunarWeb and LunarMail underscores the persistent threat posed by groups like Turla, highlighting the need for enhanced cybersecurity measures to safeguard against evolving espionage tactics in an increasingly digitized world.
