Loading malware…
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Ontinue Cyber Defence Centre has identified and reverse-engineered a four-stage attack chain associated with the Lunex Malware-as-a-Service platform, targeting Ukrainian-speaking users.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
“Psychedelic Stealer ... [is distributed] through compromised Ukrainian websites”
“The platform's capabilities extend to phishing and brand impersonation, with one panel resolving to five phishing domains.”
“[The stealer] secures persistent remote filesystem access via a PowerShell-based Native Messaging Host inside of the target’s browser.”
“The chain starts with a false CAPTCHA page and concludes with a deployed, fully featured C2 agent.”
“[The stealer] secures persistent remote filesystem access via a PowerShell-based Native Messaging Host inside of the target’s browser.”
“The platform's capabilities extend to phishing and brand impersonation” | “The attack chain begins with a fake CAPTCHA page”
"Lunex Unmasked: A New Information Stealer Deployed Through BYOVD" and "revealing a sophisticated attack chain, BYOVD techniques"
“Before the stealer is deployed, a Bring Your Own Vulnerable Driver (BYOVD) chain is run, disabling kernel-level monitoring.” | “This enables the final payload to ‘run after disabling callbacks from multiple endpoint security products.’”
“Tools like these almost always try to enumerate running processes to find security tools that can detect them.”
“The stealer exfiltrates data, extracts from cryptocurrency wallets...”
“The stealer exfiltrates data...” and the chain ends with “a deployed, fully featured C2 agent.”
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.