Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials

A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months.

The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full domain compromise.paste.txt

The attack commenced when an unsuspecting user executed a heavily obfuscated JavaScript file masquerading as a legitimate tax form, specifically named “FormW-9Ver-i4053b043910-86g91352u7972-6495q3.js”.

This malicious file, first reported by security researchers and associated with the Lunar Spider initial access group by EclecticIQ, contained minimal executable code dispersed among extensive filler content designed to evade detection systems.paste.txt

The JavaScript payload immediately triggered the download of an MSI package from a remote server, which subsequently deployed a Brute Ratel DLL file using the legitimate Windows utility rundll32.

This multi-stage approach allowed the threat actors to inject Latrodectus malware into the explorer.exe process while establishing command and control communications with multiple CloudFlare proxied domains.paste.txt

Within the first hour of access, the Latrodectus payload retrieved a specialized stealer module designed to harvest credentials from compromised systems.

The malware demonstrated sophisticated capabilities, targeting 29 different Chromium-based browsers including Google Chrome, Microsoft Edge, Yandex Browser, Vivaldi, and numerous other variants. Firefox received separate handling through profile enumeration targeting cookies.sqlite database files.paste.txt

The credential harvesting extended beyond browsers to include email configurations from Microsoft Outlook across Office versions 11.0-17.0 by querying Windows registry keys.

The stealer extracted server configurations including SMTP, POP3, IMAP, and NNTP server addresses, port numbers, usernames, and encrypted passwords, providing the attackers with comprehensive access to the victim’s communication infrastructure.paste.txt

Domain Administrator Access

The threat actors’ persistence paid dividends on day three when they discovered an unattend.xml Windows Answer file containing plaintext domain administrator credentials left over from an automated deployment process.

On day four, the threat actor deployed and executed a binary named lsassa.exe via BackConnect on the beachhead host.

This discovery provided immediate high-privilege access to the domain environment, dramatically expanding their potential impact and lateral movement capabilities.paste.txt

Throughout the campaign, Lunar Spider employed sophisticated evasion techniques including process injection into legitimate Windows processes such as explorer.exe, sihost.exe, and spoolsv.exe.

They established multiple persistence mechanisms, including Registry Run keys and scheduled tasks, ensuring their access would survive system restarts and basic remediation attempts.paste.txt

The attackers deployed multiple command and control frameworks including Brute Ratel, Latrodectus, and Cobalt Strike beacons, creating redundant communication channels with their infrastructure.

This multi-layered approach demonstrated advanced operational security practices typical of professional cybercriminal organizations.paste.txt

Extended Dwell Time

Remarkably, the threat actors maintained intermittent command and control access for nearly two months following initial compromise.

On day twenty of the intrusion, they successfully exfiltrated data from file share servers using a renamed Rclone binary over FTP connections, with the exfiltration process spanning approximately ten hours.paste.txt

Despite the extended dwell time and comprehensive access to critical infrastructure, no ransomware deployment was observed during this intrusion, suggesting the attackers prioritized data theft over destructive activities.

The campaign highlights the persistent threat posed by well-resourced cybercriminal groups and the importance of robust security monitoring and rapid incident response capabilities.paste.txt

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.