To the Moon and back(doors): Lunar landing in diplomatic missions

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – A malicious Word document installs LunarMail via a macro. ‘This document has unusual components: 32- and 64-bit versions of a Stage 1 loader, and a Stage 2 blob containing the LunarMail backdoor.’
• [T1137.006] Office Application Startup: Add-ins – LunarMail loader is persisted as an Outlook add-in. ‘Persistence via Outlook add-in’ (Stage 0 – LunarMail initial user compromise).
• [T1137] Group Policy extension (T1137.006 under MITRE table) – Group Policy extension used to maintain persistence for LunarWeb loader. ‘The attacker set up a Group Policy extension in the registry using the Remote Registry service.’
• [T1620] Reflective Code Loading – LunarLoader uses a reflective loader to execute a decrypted payload. ‘This function contains a reflective loader.’
• [T1027.003] Obfuscated Files or Information: Steganography – Commands hidden in images via steganography. ‘Both backdoors employ the technique of steganography, hiding commands in images to avoid detection.’
• [T1573.001] Encrypted Channel: Symmetric Cryptography – C2 communications encrypted with AES-256. ‘encrypt C&C communications using AES-256.’
• [T1573.002] Encrypted Channel: Asymmetric Cryptography – RSA-4096 used for decrypting incoming data / key exchange. ‘RSA-4096 keys for decrypting incoming data.’
• [T1071.001] Application Layer Protocol: Web Protocols – LunarWeb communicates over HTTP(S). ‘LunarWeb communicates with its C&C server using HTTP(S)…’
• [T1071.003] Application Layer Protocol: Mail Protocols – LunarMail uses email messages for C2 communications. ‘LunarMail communicates via email messages for C&C purposes.’
• [T1113] Screen Capture – LunarMail can capture screenshots. ‘Screen Capture’ in LunarMail commands.
• [T1114.001] Email Collection: Local Email Collection – LunarMail collects recipients of sent emails (and Outlook profile data). ‘recipients of all sent email messages (email addresses).’
• [T1005] Data from Local System – LunarWeb/LunarMail upload files from the compromised machine. ‘upload files from the compromised machine.’
• [T1560.002] Archive Collected Data: Archive via Library – Compression of data using zlib. ‘statically linked zlib library for compression of collected data.’
• [T1020] Data Obfuscation: Steganography (Data in images) – data hidden in PNGs or PDFs with embedded content. ‘hiding data in image structures’; ‘data embedded in the structures of the image format.’
• [T1041] Exfiltration Over C2 Channel – Data exfiltrated over the C2 channel. ‘exfiltrate data over the C&C channel.’
• [T1071.004] Encrypted Channel: Web Services (additional reference) – Not explicitly listed, but aligns with multiple encrypted channels described. (Note: primary encrypted channels are T1573.001/002.)