LunarMail (Backdoor) – Malware

Overview

LunarMail is a highly sophisticated backdoor malware that has been making waves in the cybersecurity community due to its advanced capabilities and stealthy operations. Primarily targeting Windows-based systems, LunarMail is designed to provide attackers with persistent access to compromised machines, enabling them to execute arbitrary commands, collect sensitive information, and exfiltrate data. This malware is typically distributed through malicious Word documents embedded with VBA macros, which, once opened, download and install the LunarMail payload.

One of the standout features of LunarMail is its use of reflective code loading. This technique allows the malware to run in memory without being written to the disk, significantly reducing the chances of detection by traditional antivirus software. LunarMail further enhances its stealth with AES-256 encryption for both its stored files and its communication with command and control (C2) servers. The malware also uses legitimate-looking filenames and locations to masquerade as benign software components, making it difficult for defenders to identify and remove it.

Persistence is a critical aspect of LunarMail’s functionality. The malware ensures it remains active on infected systems through various methods, including being loaded as an Outlook add-in or using a trojanized version of the AdmPwd DLL. By embedding itself within common system processes and leveraging the Windows Management Instrumentation (WMI) for execution, LunarMail can seamlessly integrate into the operating environment, making it resilient against removal attempts. Furthermore, LunarMail employs steganography for C2 communications, hiding commands within PNG images and exfiltrating data in a similarly concealed manner. This not only obfuscates its activities but also helps it evade network monitoring tools.

LunarMail’s reconnaissance capabilities are particularly concerning. The malware can gather extensive information about the infected system, including environment variables, network configurations, and security software details. This information allows attackers to adapt their tactics to the specific environment, increasing the effectiveness of their operations. LunarMail also has the ability to capture screenshots and collect email addresses from Outlook profiles, further enhancing its data collection capabilities. Once the data is gathered, it is compressed and encrypted before being sent to the C2 servers, ensuring that sensitive information is securely transmitted.

The use of LunarMail by attackers indicates a high level of sophistication and intent. Its ability to maintain long-term access, evade detection, and securely exfiltrate data makes it a formidable threat. Organizations must adopt a multi-layered security approach to defend against such advanced threats. This includes the implementation of advanced threat detection and response solutions, regular security audits, and comprehensive employee training to recognize and avoid phishing attempts.

In conclusion, LunarMail represents a significant evolution in malware technology, combining advanced techniques for persistence, stealth, and data exfiltration. Its capabilities highlight the need for continuous improvement in cybersecurity measures and the importance of staying informed about emerging threats. As cybercriminals continue to develop more sophisticated tools, the cybersecurity community must remain vigilant and proactive in defending against such threats.

Targets

European Ministry of Foreign Affairs (MFA) and its diplomatic missions abroad

How they operate

LunarMail, a sophisticated backdoor malware, has emerged as a formidable threat in the cybersecurity landscape, primarily targeting Windows-based systems. Its intricate operation, stealth techniques, and persistent capabilities make it a significant concern for security professionals. Distributed through malicious Word documents embedded with VBA macros, LunarMail is designed to give attackers long-term access to compromised systems, allowing them to execute commands, gather sensitive information, and exfiltrate data with minimal risk of detection.

Once a victim opens the malicious Word document, the embedded macro initiates the download and installation of the LunarMail payload. One of the malware’s standout features is its use of reflective code loading, which allows it to run directly from memory without being written to disk. This technique significantly reduces the likelihood of detection by traditional antivirus software. Additionally, LunarMail employs AES-256 encryption for its stored files and communications with command and control (C2) servers, further enhancing its stealth.

Persistence is a critical component of LunarMail’s operation. The malware ensures it remains active on infected systems through various methods, including being loaded as an Outlook add-in or using a trojanized version of the AdmPwd DLL. By embedding itself within common system processes and leveraging Windows Management Instrumentation (WMI) for execution, LunarMail seamlessly integrates into the operating environment. This makes it resilient against removal attempts and allows it to operate undetected for extended periods.

LunarMail’s use of steganography for C2 communications is particularly noteworthy. The malware hides its commands within PNG images and exfiltrates data in a similarly concealed manner. This approach not only obfuscates its activities but also helps it evade network monitoring tools. By mimicking legitimate network traffic, LunarMail’s communications blend in with normal operations, making it difficult for security professionals to identify and block malicious activities.

The reconnaissance capabilities of LunarMail are extensive and concerning. The malware can gather detailed information about the infected system, including environment variables, network configurations, and installed security software. It can also capture screenshots and collect email addresses from Outlook profiles. This collected data is then compressed and encrypted before being transmitted to the C2 servers, ensuring that sensitive information is securely exfiltrated. LunarMail’s ability to adapt to the specific environment of the compromised system increases the effectiveness of the attackers’ operations.

MITRE tactics and techniques

Reconnaissance:

T1591: Gather Victim Org Information

Resource Development:

T1583.002: Acquire Infrastructure: DNS Server
T1583.003: Acquire Infrastructure: Virtual Private Server
T1584.003: Compromise Infrastructure: Virtual Private Server
T1586.002: Compromise Accounts: Email Accounts
T1587.001: Develop Capabilities: Malware

Execution:

T1047: Windows Management Instrumentation
T1059: Command and Scripting Interpreter
T1059.001: Command and Scripting Interpreter: PowerShell
T1059.003: Command and Scripting Interpreter: Windows Command Shell
T1059.005: Command and Scripting Interpreter: Visual Basic
T1106: Native API
T1204.002: User Execution: Malicious File

Persistence:

T1137.006: Office Application Startup: Add-ins
T1547: Boot or Logon Autostart Execution
T1574: Hijack Execution Flow

Defense Evasion:

T1027: Obfuscated Files or Information
T1027.003: Obfuscated Files or Information: Steganography
T1027.007: Obfuscated Files or Information: Dynamic API Resolution
T1027.009: Obfuscated Files or Information: Embedded Payloads
T1036.005: Masquerading: Match Legitimate Name or Location
T1070.004: Indicator Removal: File Deletion
T1070.008: Indicator Removal: Clear Mailbox Data
T1140: Deobfuscate/Decode Files or Information
T1480.001: Execution Guardrails: Environmental Keying
T1620: Reflective Code Loading

Discovery:

T1007: System Service Discovery
T1016: System Network Configuration Discovery
T1057: Process Discovery
T1082: System Information Discovery
T1518.001: Software Discovery: Security Software Discovery

Collection:

T1005: Data from Local System
T1074.001: Data Staged: Local Data Staging
T1113: Screen Capture
T1114.001: Email Collection: Local Email Collection
T1560.002: Archive Collected Data: Archive via Library

Command and Control:

T1001.002: Data Obfuscation: Steganography
T1001.003: Data Obfuscation: Protocol Impersonation
T1071.001: Application Layer Protocol: Web Protocols
T1071.003: Application Layer Protocol: Mail Protocols
T1090.001: Proxy: Internal Proxy
T1095: Non-Application Layer Protocol
T1132.001: Data Encoding: Standard Encoding
T1573.001: Encrypted Channel: Symmetric Cryptography
T1573.002: Encrypted Channel: Asymmetric Cryptography

Exfiltration:

T1020: Automated Exfiltration
T1030: Data Transfer Size Limits
T1041: Exfiltration Over C2 Channel

References:

• To the Moon and back(doors): Lunar landing in diplomatic missions
• LunarWeb and LunarMail Backdoors Used by Turla Group to Target Diplomatic Missions – Active IOCs
• Turla APT Hackers Target EU Foreign Affairs With ‘LunarMail’ Backdoor