LUNA Ransomware Attack Pattern Analysis

This report analyzes LUNA (REF5264), a Rust-based ransomware family with cross-platform Windows and Linux samples. It documents execution arguments (-file, -dir), differences between a more mature Windows variant and a less-polished Linux variant, service/process termination and drive enumeration techniques, a per-file X25519 key-exchange → AES-CTR encryption scheme with a hardcoded IV and embedded public keys, the ransom note behavior, and detection guidance including a YARA rule and an endpoint prevention rule targeting pre-encryption defense-evasion TTPs.