Lunex MaaS Platform Information Stealer Analysis

The Ontinue Cyber Defence Centre has identified a significant expansion of the Lunex Malware-as-a-Service (MaaS) platform, now encompassing 28 active panels across 13 countries. The threat, likely originating from Russian-speaking developers, targets Ukrainian users via fake CAPTCHA lures and silent MSI installers. The platform has evolved from a simple stealer into a full crimeware suite capable of brand impersonation, web injects, and persistent remote filesystem control.

Technically, the attack chain is notable for its use of the Bring Your Own Vulnerable Driver (BYOVD) technique, specifically exploiting CVE-2023-20598 in the AMD PDFWKRNL.sys driver. This driver is used to zero out kernel callbacks for 20 major security products, including Microsoft Defender, Kaspersky, and CrowdStrike, effectively blinding EDR tools without terminating their processes. The final payload, LunexStealer, implements advanced credential theft for Chromium-based browsers and crypto wallets, alongside direct syscalls to bypass user-mode hooks.

The rapid growth of the Lunex infrastructure and its sophisticated EDR evasion capabilities pose a high risk to organizations. The platform's use of Chrome Native Messaging Hosts for persistence is particularly dangerous, as it allows for continued filesystem access even after the primary malware executable is removed.