Turla Group Deploys LunarWeb and LunarMail Backdoors in Diplomatic Missions
Two previously unreported backdoors identified as LunarWeb and LunarMail were directed towards an unidentified European Ministry of Foreign Affairs (MFA) and its three diplomatic missions in the Middle East.
Using tactical overlaps with previous campaigns identified as being directed by the group, ESET, which detected the activity, linked it with medium confidence to the Russia-aligned cyberespionage group Turla (also known as Iron Hunter, Pensive Ursa, Secret Blizzard, Snake, Uroburos, and Venomous Bear).
Security researcher Filip Jurčacko stated that LunarWeb, which is installed on servers, mimics normal requests and uses HTTP(S) for its C&C [command-and-control] communications, while LunarMail, which is installed on workstations, is persistent as an Outlook add-in and uses em...