Эксперты из ESET have discovered two previously unknown malicious tools that attacked the European Ministry of Foreign Affairs and its diplomatic missions abroad for cyber espionage.
Given the similarities between tactics, techniques, and procedures, ESET researchers атрибут this activity to the Russian cyber spy group Turla, which primarily targets government and diplomatic organizations in Europe, Central Asia, and the Middle East.
Launching backdoors
The attackers deployed backdoors with the names LunarWeb and LunarMail in the diplomatic mission. In another attack, LunarWeb was deployed in three diplomatic missions of a European country in the Middle East within minutes of each other. It is likely that the attackers had prior access to the domain controller of the Ministry of Foreign Affairs and used it to further spread to devices of related institutions on the same network.
The LunarWeb threat collects and intercepts information from the system, such as computer and operating system data, a list of running processes, services, and installed security products. In addition, the tool can perform operations on files and processes, as well as run commands. During the first launch, the LunarMail backdoor collects email addresses from the recipients’ sent email messages. LunarMail can also create a new process and take screenshots.
The stolen credentials help Russian cybercriminals spread the threat online.
“We observed varying degrees of sophistication during the infection, such as installing on a compromised server to avoid detection by security programs, contrasted with coding errors and different backdoor coding styles. This suggests that multiple people were likely involved in the development and use of these tools,”