MITRE ATT&CKsoftware (malware)
S1142 LunarMail
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2024-06-26
Description
LunarMail is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) in conjunction with LunarLoader and LunarWeb. LunarMail is designed to be deployed on workstations and can use email messages and Steganography in command and control.
Related
Uses · MITRE ATT&CK (17)
- T1027.013 Encrypted/Encoded File sub-technique
- T1070.008 Clear Mailbox Data sub-technique
- T1001.002 Steganography sub-technique
- T1071.003 Mail Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1204.002 Malicious File sub-technique
- T1059.005 Visual Basic sub-technique
- T1114.001 Local Email Collection sub-technique
- T1070.004 File Deletion sub-technique
- T1543 Create or Modify System Process technique
- T1137.006 Add-ins sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1113 Screen Capture technique
Referenced by MITRE ATT&CK · uses (1)
- G0010 Turla group
References
- https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/ ESET Turla Lunar toolset May 2024