Lunex Infostealer Uses BYOVD Chain to Target Ukrainian Users

Ontinue Cyber Defence Centre identified a four-stage campaign delivering the Lunex malware-as-a-service infostealer against apparent Ukrainian targets. Researchers assess with confidence that a financially motivated, CIS-aligned actor operates the service; Lunex is believed to have been developed by a Russian-speaking individual or team and sold to other cybercriminals.

The attack begins with a fake CAPTCHA page and uses a bring-your-own-vulnerable-driver (BYOVD) chain to undermine kernel-level security monitoring before installing a command-and-control-capable infostealer. Lunex steals victim data and cryptocurrency-wallet contents, and it maintains remote filesystem access through a PowerShell-based Native Messaging Host installed in the victim's browser.