Lunar Spider chain deploys Latrodectus, Brute Ratel, Cobalt Strike
A malicious tax-form JavaScript tied to Lunar Spider led to a nearly two-month intrusion using Latrodectus, Brute Ratel, Cobalt Strike, BackConnect and a custom .NET backdoor before data exfiltration.
The DFIR Report details a May 2024 intrusion beginning with a user executing an obfuscated JavaScript file disguised as a W-9 tax form, linked to the Lunar Spider initial-access group. The script downloaded an MSI installer that deployed Brute Ratel via rundll32, which in turn injected Latrodectus into explorer.exe and established C2 over CloudFlare-proxied domains. Within hours the actor pivoted to BackConnect VNC access, and by day three had located plaintext domain admin credentials in an unattend.xml answer file, granting immediate high-privilege access.
Over the following weeks the actor layered in Cobalt Strike beacons, a custom .NET backdoor (lsassa.exe) with its own C2 channel, and attempted lateral movement using PsExec, RDP, AdFind-based AD enumeration, a Zerologon (CVE-2020-1472) exploitation attempt, and a UAC bypass via ms-settings protocol hijacking. Credentials were harvested from LSASS, browsers via a Latrodectus stealer module, and Veeam Credential Manager using the publicly available Veeam-Get-Creds.ps1 script — a technique previously associated with ransomware actors targeting backup infrastructure. On day 20, data was exfiltrated from a file server via a renamed Rclone binary over FTP.
Despite nearly two months of intermittent C2 access, extensive AD reconnaissance, and access to domain controllers and backup systems, no ransomware was deployed before the actor was evicted. The report ties the initial JavaScript sample to the broader Latrodectus/Brute Ratel tax-themed phishing campaign documented by Trustwave and Rapid7 following the Operation Endgame botnet takedowns in May 2024.
Mentioned in this report
Detection guidance
Process Injection via CreateRemoteThread into Explorer
Child process injecting into explorer.exe, characteristic of RAT loaders establishing persistence by hijacking the Windows shell process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Injection via CreateRemoteThread into Explorer
description: Detects process injection patterns where a suspicious parent (rundll32,
javascript, wscript) injects code into explorer.exe - typical behaviour of RAT payloads
like Latrodectus establishing a stable foothold.
tags:
- attack.defense-evasion
- attack.privilege-escalation
- attack.t1055
logsource:
category: process_creation
product: windows
detection:
selection:
TargetImage|endswith: \explorer.exe
SourceImage|endswith:
- \rundll32.exe
- \wscript.exe
- \cscript.exe
- \msiexec.exe
filter_admin_tools:
SourceImage|endswith:
- \svchost.exe
- \services.exe
condition: selection and not filter_admin_tools
falsepositives:
- Shell extension or Windows component legitimate injection into explorer
level: high
id: e8fca861-a943-5dc1-b365-788d3ab67466
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free