Russian hackers use new Lunar malware to breach a European govt's agencies

ESET researchers uncovered a long-running, targeted intrusion campaign using two backdoors—LunarWeb (server-focused) and LunarMail (Outlook-focused)—to surveil and exfiltrate data from a European Ministry of Foreign Affairs and its diplomatic missions; the malware uses steganography, a custom LunarLoader (RC4/AES-256), multiple persistence techniques, and likely leveraged domain controller access for rapid lateral movement, with IoCs provided and medium-confidence attribution to the Russian APT Turla.