Lurk

Lurk is a Russian cybercrime malware family best known as a banking trojan used to steal funds from banks, financial institutions, and commercial organizations. It has been associated with the Lurk gang, a criminal group disrupted by Russian law enforcement in 2016 after investigators linked it to large-scale financial theft. Lurk has also been tied in reporting to operators connected with the Angler exploit kit ecosystem, and historical observations indicate it was delivered as a payload by early Angler-related exploit activity.

Lurk is characterized in public reporting as a banking-focused malware operation rather than a general-purpose commodity threat. Its operators were implicated in building and managing networks of infected computers and using those infections to facilitate theft from financial targets. The malware’s operational model places it in the broader lineage of post-Carberp Russian-speaking financial malware campaigns that combined exploit-driven infection chains with organized monetization.

Observed delivery relationships connect Lurk to exploit-kit-based compromise, particularly Angler, including early fileless-style exploit activity against browser users. Reporting also links the broader Lurk gang to criminal advertising and exploit-kit distribution ecosystems active in the mid-2010s. The campaign’s victimology centered on financial entities and businesses, with activity especially noted in Russia and neighboring regional contexts.

At high confidence, Lurk should be understood as Windows banking malware used for financially motivated intrusions and theft, with exploit-kit delivery playing a documented role in at least part of its historical deployment.