Hide Navigation Hide TOC

LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)

LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.(Citation: ESET Turla Lunar toolset May 2024)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)	Malware	Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	1
LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)	Malware	Add-ins - T1137.006 (34f1d81d-fe88-4f97-bd3b-a3164536255d)	Attack Pattern	1
LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)	Malware	Execution Guardrails - T1480 (853c4192-4311-43e1-bfbb-b11b14911852)	Attack Pattern	1
LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)	Malware	Reflective Code Loading - T1620 (4933e63b-9b77-476e-ab29-761bc5b7d15a)	Attack Pattern	1
LunarLoader - S1143 (6490afef-d88e-4e2b-b9d9-a472508ca59d)	Malware	System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0)	Attack Pattern	1
Add-ins - T1137.006 (34f1d81d-fe88-4f97-bd3b-a3164536255d)	Attack Pattern	Office Application Startup - T1137 (2c4d4e92-0ccf-4a97-b54c-86d662988a53)	Attack Pattern	2