Lunarmail

LunarMail, a novel backdoor linked to the Russia-associated Turla APT, has been discovered by ESET researchers as part of a cyber-espionage campaign targeting European government agencies. First observed in 2020, this sophisticated threat actor leverages two custom backdoors, LunarWeb and LunarMail, that employ advanced techniques like steganography and Lua scripting. LunarWeb is typically deployed on servers and uses HTTP(S) for command and control (C&C) communications, mimicking legitimate requests to evade detection. LunarMail, on the other hand, is deployed on workstations with Microsoft Outlook and uses email messages for its C&C communications, exploiting the Outlook Messaging API (MAPI) to avoid detection in environments where HTTPS traffic is monitored. The LunarMail backdoor is persisted as an Outlook add-in and is capable of creating processes, taking screenshots, writing files, and executing Lua scripts. Although it does not have separate commands for running shell or PowerShell commands, the ability to execute Lua scripts enables it to indirectly run these commands. The campaign also involved spear-phishing attacks, including a weaponized Word document used to install the LunarMail backdoor, thereby increasing the reach and effectiveness of the attack. Both LunarWeb and LunarMail exfiltrate data over their respective C&C channels, posing a significant threat to the security of sensitive information. The association of these tools with the Turla APT, a group known for its links to Russian state interests, underscores the geopolitical implications of this campaign. This discovery highlights the need for robust cybersecurity measures, particularly for entities dealing with sensitive data, to counter such sophisticated threats.