LunarLoader
MITRE ATT&CK: S1143 View on attack.mitre.org
Aliases: LunarLoader
- First seen
- 2020-01-01 00:00:00
- Malware type
- loader
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 15:10:34
Targeted industries: government-and-public-sector
Targeted regions: country_code:fr
Context
LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.
Detection coverage
- 30 Sigma rules
Malware & tools used
- System Network Configuration Discovery (attack-pattern)
- Execution Guardrails (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Add-ins (attack-pattern)
- Reflective Code Loading (attack-pattern)
Used by threat actors
- Turla (threat-actor)
Reports & references
- ESET — Moon Backdoors Lunar Landing Diplomatic Missions (report)
- MITRE ATT&CK — S1143 (report)