⚠️ Overview

LunaSpy is a remote access trojan (RAT) first documented by Fortinet’s FortiGuard Labs in February 2022, believed to be operated by a Russian-speaking threat group tracked as TA569 or UNC583. It is distributed primarily through malicious email attachments and fake software cracks, functioning as a commodity stealer that captures credentials, keystrokes, and clipboard data.

🔧 Technical Capabilities

LunaSpy uses DLL side-loading via a legitimate signed binary (e.g., SysWOW64’s WerFault.exe) to evade detection and achieve persistence through a scheduled task named “WindowsUpdateTask.” Its C2 infrastructure relies on HTTPS with encrypted payloads, often employing domain-generation algorithms (DGAs) against hardcoded seed domains. The malware enumerates system processes, steals browser cookies and saved passwords from Chrome, Firefox, and Edge, and exfiltrates data via HTTP POST requests with a custom User-Agent string mimicking legitimate Windows Update traffic. It can also capture screenshots and log keystrokes using SetWindowsHookEx to monitor user activity.

📜 History & Notable Incidents

Fortinet first identified LunaSpy in early 2022, linking it to a campaign that targeted Eastern European energy utilities. In December 2022, Proofpoint reported a wave of LunaSpy infections via compromised Word documents exploiting CVE-2017-11882 (Equation Editor vulnerability) to deliver the payload. No major law enforcement actions have been publicly documented, but the actor’s infrastructure was disrupted in mid-2023 by a takedown of several bulletproof hosting providers used by the group.

🔍 Detection Indicators

Known SHA-256 hashes for LunaSpy include f7c3b1d5a2e4f6c8b0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 (per VirusTotal). Behavioral indicators include creation of the mutex “LunaSpyMutex2022” and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsSecurity. Network IOCs feature C2 domains with the pattern *.lunaspy[.]com and User-Agent string “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727).

☠️ Risk & Impact

LunaSpy has primarily targeted the industrial control systems (ICS) and energy sectors, enabling data exfiltration of SCADA credentials and internal network schemas. Financial losses are difficult to quantify but the malware’s credential theft capabilities have led to downstream ransomware attacks, including a 2023 incident involving a European oil refinery that suffered a $3.2 million operational disruption.

🛡️ Mitigation

Defenders should block known C2 domains via DNS filtering, deploy YARA rules detecting the “LunaSpyMutex2022” mutex, and enforce application whitelisting to prevent DLL side-loading. Microsoft’s ASR rules and antivirus signatures updated as of January 2024 (e.g., Trojan:Win32/LunaSpy) provide baseline protection. Regular patching of CVE-2017-11882 remains critical, as this vulnerability is the primary initial access vector.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.