Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials

Lunar Spider is described as a sophisticated cybercriminal group that compromised a Windows machine with a single malicious click and then harvested credentials while maintaining persistent access for nearly two months. The intrusion began in May 2024, after a user ran a heavily obfuscated JavaScript file masquerading as a legitimate FormW-9, first reported by security researchers and associated with Lunar Spider by EclecticIQ.

The payload prompted the download of an MSI package that deployed a Brute Ratel DLL via rundll32, allowing Latrodectus malware to be injected into explorer.exe and contact multiple CloudFlare proxied domains for command and control. Within the first hour, a stealer module began harvesting credentials from 29 Chromium-based browsers and email configurations from Microsoft Outlook across Office versions, including registry keys with server details and encrypted passwords.

On day three the attackers found an unattend.xml containing plaintext domain administrator credentials, and by day four they dropped lsassa.exe via BackConnect to expand privileges and lateral movement. Throughout the campaign they used process injection into legitimate Windows processes, multiple persistence mechanisms, andBeacons from Brute Ratel, Latrodectus, and Cobalt Strike to maintain access, with intermittent exfiltration from file shares over about ten hours on day twenty.