S1143 LunarLoader

malwareEnterprise

platformsWindows

also known asLunarLoader

LunarLoader is the loader component for the LunarWeb and LunarMail backdoors that has been used by Turla since at least 2020 including against a European ministry of foreign affairs (MFA). LunarLoader has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.

techniques used (5)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1137.006Add-ins
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
T1620Reflective Code Loading

used by groups (1)

Threat groups associated with this.

G0010Turla

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan