Lunar Spider chain deploys Latrodectus, Brute Ratel, Cobalt Strike
A malicious tax-form JavaScript tied to Lunar Spider led to a nearly two-month intrusion using Latrodectus, Brute Ratel, Cobalt Strike, BackConnect and a custom .NET backdoor before data exfiltration.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2020-1472 as exploited in the wild.
The DFIR Report details a May 2024 intrusion beginning with a user executing an obfuscated JavaScript file disguised as a W-9 tax form, linked to the Lunar Spider initial-access group. The script downloaded an MSI installer that deployed Brute Ratel via rundll32, which in turn injected Latrodectus into explorer.exe and established C2 over CloudFlare-proxied domains. Within hours the actor pivoted to BackConnect VNC access, and by day three had located plaintext domain admin credentials in an unattend.xml answer file, granting immediate high-privilege access.
Over the following weeks the actor layered in Cobalt Strike beacons, a custom .NET backdoor (lsassa.exe) with its own C2 channel, and attempted lateral movement using PsExec, RDP, AdFind-based AD enumeration, a Zerologon (CVE-2020-1472) exploitation attempt, and a UAC bypass via ms-settings protocol hijacking. Credentials were harvested from LSASS, browsers via a Latrodectus stealer module, and Veeam Credential Manager using the publicly available Veeam-Get-Creds.ps1 script — a technique previously associated with ransomware actors targeting backup infrastructure. On day 20, data was exfiltrated from a file server via a renamed Rclone binary over FTP.
Despite nearly two months of intermittent C2 access, extensive AD reconnaissance, and access to domain controllers and backup systems, no ransomware was deployed before the actor was evicted. The report ties the initial JavaScript sample to the broader Latrodectus/Brute Ratel tax-themed phishing campaign documented by Trustwave and Rapid7 following the Operation Endgame botnet takedowns in May 2024.
Mentioned in this report
Source reporting: https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs