To the Moon and back(doors): Lunar landing in diplomatic missions

ESET researchers uncovered two novel backdoors, LunarWeb (server-side, HTTP(S) C2 with protocol impersonation and steganography) and LunarMail (Outlook add-in, email-based C2 with PNG/PDF steganographic exfiltration), used since at least 2020 to compromise a European ministry of foreign affairs and its diplomatic missions; the toolset uses environmental keying, reflective loading, RSA-4096/AES-256 encryption, supports Lua scripting, multiple persistence techniques, and includes extensive IoCs and MITRE ATT&CK mappings, with attribution to the Turla APT at medium confidence.