Record · corpus.blog/posts/01a0f9c8-1b5a-7229-8dfd-6c0b0ad26ab9

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

thedfirreport.com · published 29 September 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at thedfirreport.com Wayback capture

1blogs citing

First cited: 11 Oct 2025
Most recent: 11 Oct 2025
Rank this month: not ranked
External links: 23
Words captured: 6,408

Cited by

Blog

In the post

Date

magonia.io

"That Can be Evaded" and the Imperfect Detector Read at the source ↗

11 Oct 2025

Links from this post

Link

Host

https://blog.eclecticiq.com/inside-intelligence-center-lunar-spider-enabling-ransomware-attacks-on-financial-sector-with-brute-ratel-c4-and-latrodectus

blog.eclecticiq.com

https://x.com/RussianPanda9xx

x.com

https://www.linkedin.com/in/christos-fotopoulos-535b2b217/

linkedin.com

https://www.linkedin.com/in/salemcubed/

linkedin.com

https://twitter.com/svch0st

twitter.com

https://www.europol.europa.eu/media-press/newsroom/news/operation-endgame-strikes-again-ransomware-kill-chain-broken-its-source

europol.europa.eu

https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/analyzing-latrodectus-the-new-face-of-malware-loaders/

trustwave.com

https://www.rapid7.com/blog/post/2024/07/24/malware-campaign-lures-users-with-fake-w2-form/

rapid7.com

https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice

proofpoint.com

https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid

malpedia.caad.fkie.fraunhofer.de

https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus

elastic.co

https://medium.com/walmartglobaltech/keyhole-analysis-60302922aa03

medium.com

https://cn-sec.com/archives/343089.html

cn-sec.com

https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_privilege-escalation.htm

hstechdocs.helpsystems.com

https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/

winscripting.blog

https://www.bitsight.com/blog/latrodectus-are-you-coming-back

bitsight.com

https://en.wikipedia.org/wiki/Process_Environment_Block

en.wikipedia.org

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs?view=windows-11

learn.microsoft.com

https://github.com/sadshade/veeam-creds

github.com

http://tyk.io/

tyk.io

https://detection.fyi/

detection.fyi

https://sigmasearchengine.com/

sigmasearchengine.com

https://github.com/The-DFIR-Report/Yara-Rules/blob/main/28761/28761.yar

github.com

Elsewhere on thedfirreport.com (74)

https://thedfirreport.com/services/dfir-labs/ctf/

thedfirreport.com

https://dfirlabs.thedfirreport.com/store

dfirlabs.thedfirreport.com

https://dfirlabs.thedfirreport.com/subscription-plans

dfirlabs.thedfirreport.com

https://thedfirreport.com/subscribe/

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_001.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_002.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_003.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_004.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_005.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_006_01.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_007.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_008.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_009.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_010.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_011.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_012.png

thedfirreport.com

https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_013.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_014.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_015.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_016.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_017.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_018.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_019.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_020.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_021.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_022.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_023.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_024.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_025.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_026.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_027.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_028.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_029.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_030.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_031.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_032.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_033.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_034.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_035.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_036.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_037.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_038.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_039.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_040.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_041.png

thedfirreport.com

https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_042.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_043.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_044.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_045.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_046.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_047.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_048.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_049.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_050.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_051.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_052.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_053.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_054.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_055.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_056.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_057.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_058.png

thedfirreport.com

https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_059.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_060.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_061.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_062.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_063.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_064.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_065.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_066_01-scaled.png

thedfirreport.com

https://thedfirreport.com/wp-content/uploads/2025/09/28761_067.png

thedfirreport.com