Threat intelligence / Malware

LunarWeb

[LunarWeb](https://attack.mitre.org/software/S1141) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with [LunarLoader](https://attack.mitre.org/software/S1143) and [LunarMail](https://attack.mitre.org/software/S1142). [LunarWeb](https://attack.mitre.org/software/S1141) has only been observed deployed against servers and can use [Steganography](https://attack.mitre.org/techniques/T1001/002) to obfuscate command and control.(Citation: ESET Turla Lunar toolset May 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LunarWeb](https://attack.mitre.org/software/S1141) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with [LunarLoader](https://attack.mitre.org/software/S1143) and [LunarMail](https://attack.mitre.org/software/S1142). [LunarWeb](https://attack.mitre.org/software/S1141) has only been observed deployed against servers and can use [Steganography](https://attack.mitre.org/techniques/T1001/002) to obfuscate command and control.(Citation: ESET Turla Lunar toolset May 2024)

Labels

malware

31 recorded

Relationships

uses

to Archive via Library

Technique

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Group Policy Discovery

Technique

uses

to Inter-Process Communication

Technique

uses

to Local Groups

Technique

uses

to Multi-Stage Channels

Technique

uses

to Network Share Discovery

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Software Discovery

Technique

uses

to Standard Encoding

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

from Turla

Group

2 external

References

mitre-attack

S1141

ESET Turla Lunar toolset May 2024

https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/