Loading story…
Ontinue Cyber Defence Centre identified a four-stage campaign delivering the Lunex malware-as-a-service infostealer against apparent Ukrainian targets. Researchers assess with confidence that a financially motivated, CIS-aligned actor operates the service; Lunex is believed to have been developed by a Russian-speaking individual or team and sold to other cybercriminals.
The attack begins with a fake CAPTCHA page and uses a bring-your-own-vulnerable-driver (BYOVD) chain to undermine kernel-level security monitoring before installing a command-and-control-capable infostealer. Lunex steals victim data and cryptocurrency-wallet contents, and it maintains remote filesystem access through a PowerShell-based Native Messaging Host installed in the victim's browser.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Ontinue assessed with confidence that a financially motivated, CIS-aligned threat actor operates through Lunex. Researchers believe the platform was developed by a Russian-speaking individual or team and is sold to cybercriminals.
Ontinue Cyber Defence Centre reverse-engineered a four-stage campaign linked to the Lunex malware-as-a-service platform, which appears to target Ukrainian users. The chain starts with a fake CAPTCHA page, uses a BYOVD chain to impair kernel-level security monitoring, and deploys a C2-capable infostealer that steals victim and cryptocurrency-wallet data and establishes persistent browser-based remote filesystem access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Suspected Russian threat actors breached Ukrainian organizations by leveraging 'living-off-the-land' (LotL) techniques, primarily using legitimate administrative tools and minimal custom malware to evade detection and maintain persistence. The attacks, detailed by Symantec and Carbon Black, targeted a large business services company and a local government agency, with initial access achieved through webshells—most notably the Localolive webshell, previously associated with the Sandworm group. Attackers exploited unpatched vulnerabilities on public-facing servers to deploy these webshells, then used PowerShell backdoors and scheduled tasks to further their objectives, including data exfiltration and system reconnaissance. The threat actors demonstrated advanced knowledge of Windows native tools, running commands to exclude certain directories from antivirus scans, dumping registry hives, and enumerating files and processes—potentially to target password managers like KeePass. The use of dual-use tools and LotL tactics allowed the attackers to remain undetected for extended periods, highlighting the sophistication and stealth of Russian-linked cyber operations against Ukrainian targets. While a direct attribution to Sandworm was not confirmed, the tactics and tools used align with previous campaigns attributed to Russian military intelligence.
Jun 29, 2026
Threat researchers reported renewed activity from **Windows credential-stealing malware** that is designed to evade detection and rapidly scale infections. CYFIRMA described **LTX Stealer** as being delivered via a heavily obfuscated installer that abuses trusted developer and packaging tools—using *Inno Setup* to masquerade as legitimate software, embedding a full **Node.js runtime**, and compiling malicious JavaScript into bytecode to hinder reverse engineering. The installer reportedly contains an unusually large encrypted archive (hundreds of MB) intended to frustrate static scanning, and drops a payload (e.g., `updater.exe`) that functions as the bundled Node.js runtime used to execute the stealer logic. Separately, reporting citing Bitdefender said **Lumma Stealer** has returned “back at scale” after prior law-enforcement disruption of its infrastructure, rebuilding domains and command-and-control capacity to resume widespread credential and data theft. Lumma’s malware-as-a-service ecosystem continues to rely on high-conversion distribution methods, including lure sites offering pirated/cracked content and the **ClickFix** social-engineering technique that tricks users into infecting their own systems, underscoring how infostealer operators are combining resilient infrastructure with user-driven execution to maintain volume despite takedowns.
Jun 29, 2026
Researchers documented multiple **Ursnif** campaigns in which the malware evolved beyond a traditional banking trojan into a stealthy loader, reconnaissance tool, and credential theft platform. In North America and Europe, attackers hijacked existing email threads and sent links to password-protected ZIP archives containing obfuscated JavaScript, while other operations used phishing lures themed as Italian courier and energy companies with malicious Office documents. The malware chain commonly relied on Windows scripting and **LOLBins** such as `wscript` and `regsvr32`, staged DLL loading, anti-analysis tricks, and geofencing or locale checks to reduce detection and limit infections to intended victims. The activity was tied to sustained, targeted operations including campaigns attributed to **TA544** against Italian organizations and a separate **LOLSnif** variant observed from 2019 into 2020. Analysts reported that the malware reused infrastructure, bypassed local proxies through COM interfaces and Internet Explorer automation, and used WMI and broken PE headers to frustrate defenders. In several intrusions, Ursnif infections led to follow-on payloads including **Cobalt Strike Beacon**, **TeamViewer/TVRat**, and a VNC-related module, showing that the campaigns supported both credential theft and broader post-compromise remote access.
Aug 15, 2026