LunarWeb

MITRE ATT&CK: S1141 View on attack.mitre.org

Aliases: LunarWeb

First seen
2020-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:10:32

Targeted industries: government-and-public-sector

Targeted regions: country_code:eu

Context

LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.

Detection coverage

  • 513 Sigma rules

Malware & tools used

  • Steganography (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Information Discovery (attack-pattern)
  • PowerShell (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Multi-Stage Channels (attack-pattern)
  • Archive via Library (attack-pattern)
  • Time Based Checks (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Software Discovery (attack-pattern)
  • Archive via Utility (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • File Deletion (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Web Protocols (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Process Discovery (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Local Groups (attack-pattern)
  • Proxy (attack-pattern)
  • Data Transfer Size Limits (attack-pattern)

Used by threat actors

Reports & references

  • ESET — Moon Backdoors Lunar Landing Diplomatic Missions (report)
  • MITRE ATT&CK — S1141 (report)

External references