LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1141: LunarWeb

LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.[1]

EnterpriseS1141MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

LunarWeb matters because ATT&CK describes it as a Windows backdoor observed on servers, used by Turla since at least 2020, including in a European ministry of foreign affairs compromise with related Lunar tools. For leaders, the key issue is not just malware blocking; it is whether server monitoring, web egress visibility, and incident response processes can recognize stealthy command-and-control, discovery, and cleanup behavior when no official ATT&CK detection guidance is provided.

Executive priority

Prioritize this as a server resilience and espionage-readiness concern where Windows servers support sensitive operations, government-facing work, regulated data, or critical business services. Executives should ask whether security teams can prove visibility into server-side PowerShell, cmd, WMI, discovery commands, file deletion, encoded artifacts, and unusual web-based outbound traffic. The object’s Turla relationship raises threat-intelligence relevance for organizations that track state-linked espionage risk, but local exposure should be determined from asset criticality, server egress policy, and telemetry coverage—not assumed from ATT&CK alone.

Technical view

ATT&CK lists LunarWeb as Windows malware and relates it to behaviors spanning command-and-control, execution, discovery, stealth, and exfiltration support. SOC and IR teams should validate coverage for web-protocol C2, proxy use, multi-stage channels, steganography, standard encoding, encoded/encrypted files, deobfuscation, WMI, PowerShell, Windows command shell, user/group/system/network/process/software/share discovery, file and directory discovery, data transfer size limits, time-based checks, and file deletion. Because official detection text is not provided, detection engineering should map these related techniques to local Windows server telemetry and focus on correlated behavior rather than a single indicator.

Likely telemetry

  • Windows server EDR or host telemetry for process creation, parent-child process relationships, and command-line arguments
  • PowerShell logging and script block/module activity where enabled
  • WMI activity and Windows management event logs for local or remote execution patterns
  • Windows command shell execution events, especially discovery and administrative utilities on servers
  • File creation, modification, encoding/decoding, and deletion events for suspicious artifacts

Detection direction

  • Build detections around behavior clusters: server process execution plus discovery activity plus outbound web traffic is more decision-useful than any single technique match.
  • Validate visibility for PowerShell, cmd.exe, and WMI on Windows servers; these are common administrative paths, so tune against approved management systems, service accounts, and maintenance windows.
  • Review egress controls and monitoring for servers. Web traffic from servers may be legitimate, but unusual outbound HTTP/S patterns, proxy chaining, multi-stage callbacks, encoded payload characteristics, or size-limited transfers should be triaged with host context.
  • Hunt for discovery bursts covering system information, network configuration, network connections, processes, users, local groups, software, security tools, files/directories, and network shares.
  • Account for stealth behaviors: encoded/encrypted files, deobfuscation activity, file deletion, steganography, and time-based checks may reduce static signature value and sandbox reliability.

Mitigation priorities

  • Prioritize Windows server hardening and monitoring for systems with sensitive data or high business impact.
  • Restrict and monitor unnecessary outbound web access from servers; require business justification for direct internet egress where feasible.
  • Constrain administrative execution paths such as PowerShell, cmd, and WMI through least privilege, logging, and approved administration channels.
  • Maintain high-fidelity endpoint and file telemetry on servers, including process, command-line, script, WMI, and file deletion events.
  • Baseline normal server discovery and management activity so SOC teams can distinguish routine administration from suspicious enumeration.
Additional notes and limits

The supplied ATT&CK object is a malware entry, not a technique, and it has no official detection section. The strongest defensive value comes from the relationships: LunarWeb is associated with Turla and uses multiple techniques related to C2, execution, discovery, stealth, and transfer behavior. Its observed deployment against servers makes server telemetry and egress governance especially important.

This take is limited to the supplied ATT&CK fields, external references, and relationships. It does not assert current activity, customer exposure, indicators of compromise, specific infrastructure, guaranteed detection logic, or impact beyond what is provided. Local asset criticality, logging configuration, network architecture, and threat intelligence are required to turn this into environment-specific coverage decisions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

LunarWeb

LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

30 rows
DomainIDNameRelationship / procedure
EnterpriseT1615Group Policy Discovery

LunarWeb can capture information on group policy settings[1]

EnterpriseT1001.002SteganographySub-technique

LunarWeb can receive C2 commands hidden in the structure of .jpg and .gif images.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.[1]

EnterpriseT1082System Information Discovery

LunarWeb can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.[1]

EnterpriseT1059.001PowerShellSub-technique

LunarWeb has the ability to run shell commands via PowerShell.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.[1]

EnterpriseT1104Multi-Stage Channels

LunarWeb can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.[1]

EnterpriseT1560.002Archive via LibrarySub-technique

LunarWeb can zlib-compress data prior to exfiltration.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

LunarWeb can pause for a number of hours before entering its C2 communication loop.[1]

EnterpriseT1572Protocol Tunneling

LunarWeb can run a custom binary protocol under HTTPS for C2.[1]

EnterpriseT1083File and Directory Discovery

LunarWeb has the ability to retrieve directory listings.[1]

EnterpriseT1135Network Share Discovery

LunarWeb can identify shared resources in compromised environments.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

LunarWeb can send AES encrypted C2 commands.[1]

EnterpriseT1518Software Discovery

LunarWeb can list installed software on compromised systems.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

LunarWeb can create a ZIP archive with specified files and directories.[1]

EnterpriseT1016System Network Configuration Discovery

LunarWeb can use shell commands to discover network adapters and configuration.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.[1]

EnterpriseT1070.004File DeletionSub-technique

LunarWeb can self-delete from a compromised host if safety checks of C2 connectivity fail.[1]

EnterpriseT1049System Network Connections Discovery

LunarWeb can enumerate system network connections.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

LunarWeb can use `POST` to send victim identification to C2 and `GET` to retrieve commands.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

The LunarWeb install files have been encrypted with AES-256.[1]

EnterpriseT1057Process Discovery

LunarWeb has used shell commands to list running processes.[1]

EnterpriseT1047Windows Management Instrumentation

LunarWeb can use WMI queries for discovery on the victim host.[1]

EnterpriseT1069.001Local GroupsSub-technique

LunarWeb can discover local group memberships.[1]

EnterpriseT1090Proxy

LunarWeb has the ability to use a HTTP proxy server for C&C communications.[1]

EnterpriseT1030Data Transfer Size Limits

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.[1]

EnterpriseT1559Inter-Process Communication

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.[1]

EnterpriseT1132.001Standard EncodingSub-technique

LunarWeb can use Base64 encoding to obfuscate C2 commands.[1]

EnterpriseT1033System Owner/User Discovery

LunarWeb can collect user information from the targeted host.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

LunarWeb has run shell commands to obtain a list of installed security products.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1615: Group Policy DiscoveryEnterpriseuses · TechniqueT1001.002: SteganographyEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1104: Multi-Stage ChannelsEnterpriseuses · TechniqueT1560.002: Archive via LibraryEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1572: Protocol TunnelingEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
b5ecbf9c3d3cf344...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleb5ecbf9c3d3c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  2. [2]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  3. [3]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  4. [4]
    mitre-attackS1141
    Open source URL
  5. [5]
    mitre-attackS1141
    Open source URL
  6. [6]
    mitre-attackS1141
    Open source URL
  7. [7]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  8. [8]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  9. [9]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  10. [10]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  11. [11]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  12. [12]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  13. [13]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  14. [14]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  15. [15]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  16. [16]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  17. [17]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  18. [18]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  19. [19]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  20. [20]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  21. [21]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  22. [22]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  23. [23]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  24. [24]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  25. [25]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  26. [26]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  27. [27]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  28. [28]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  29. [29]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  30. [30]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  31. [31]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  32. [32]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  33. [33]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  34. [34]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  35. [35]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  36. [36]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  37. [37]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  38. [38]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  39. [39]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  40. [40]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  41. [41]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  42. [42]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  43. [43]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  44. [44]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  45. [45]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  46. [46]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  47. [47]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  48. [48]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  49. [49]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  50. [50]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  51. [51]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  52. [52]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  53. [53]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  54. [54]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  55. [55]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  56. [56]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  57. [57]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  58. [58]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  59. [59]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  60. [60]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  61. [61]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  62. [62]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  63. [63]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  64. [64]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use