MITRE ATT&CKsoftware (malware)
S1141 LunarWeb
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2024-06-26
Description
LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.
Related
Uses · MITRE ATT&CK (30)
- T1027.013 Encrypted/Encoded File sub-technique
- T1615 Group Policy Discovery technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1001.002 Steganography sub-technique
- T1071.001 Web Protocols sub-technique
- T1572 Protocol Tunneling technique
- T1132.001 Standard Encoding sub-technique
- T1069.001 Local Groups sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560.001 Archive via Utility sub-technique
- T1560.002 Archive via Library sub-technique
- T1559 Inter-Process Communication technique
- T1070.004 File Deletion sub-technique
- T1518 Software Discovery technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1030 Data Transfer Size Limits technique
- T1033 System Owner/User Discovery technique
- T1047 Windows Management Instrumentation technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
- T1104 Multi-Stage Channels technique
Referenced by MITRE ATT&CK · uses (1)
- G0010 Turla group
References
- https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/ ESET Turla Lunar toolset May 2024