Turla Group Deploys LunarWeb and LunarMail Backdoors in Diplomatic Missions
May 15, 2024
Cyber Espionage / Threat Intelligence
An unnamed European Ministry of Foreign Affairs (MFA) and its three diplomatic missions in the Middle East were targeted by two previously undocumented backdoors tracked as LunarWeb and LunarMail. ESET, which identified the activity, attributed it with medium confidence to the Russia-aligned cyberespionage group Turla (aka Iron Hunter, Pensive Ursa, Secret Blizzard, Snake, Uroburos, and Venomous Bear), citing tactical overlaps with prior campaigns identified as orchestrated by the threat actor. "LunarWeb, deployed on servers, uses HTTP(S) for its C&C [command-and-control] communications and mimics legitimate requests, while LunarMail, deployed on workstations, is persisted as an Outlook add-in and uses email messages for its C&C communications," security researcher Filip Jurčacko said . An analysis of the Lunar artifacts shows that they may have been used in targeted attacks since early 2020, or even earlier. Turla, assessed to be affiliated with Russia's Fe...
