Lunar Spider chain deploys Latrodectus, Brute Ratel, Cobalt Strike

A malicious tax-form JavaScript tied to Lunar Spider led to a nearly two-month intrusion using Latrodectus, Brute Ratel, Cobalt Strike, BackConnect and a custom .NET backdoor before data exfiltration.

The DFIR Report details a May 2024 intrusion beginning with a user executing an obfuscated JavaScript file disguised as a W-9 tax form, linked to the Lunar Spider initial-access group. The script downloaded an MSI installer that deployed Brute Ratel via rundll32, which in turn injected Latrodectus into explorer.exe and established C2 over CloudFlare-proxied domains. Within hours the actor pivoted to BackConnect VNC access, and by day three had located plaintext domain admin credentials in an unattend.xml answer file, granting immediate high-privilege access.

Over the following weeks the actor layered in Cobalt Strike beacons, a custom .NET backdoor (lsassa.exe) with its own C2 channel, and attempted lateral movement using PsExec, RDP, AdFind-based AD enumeration, a Zerologon (CVE-2020-1472) exploitation attempt, and a UAC bypass via ms-settings protocol hijacking. Credentials were harvested from LSASS, browsers via a Latrodectus stealer module, and Veeam Credential Manager using the publicly available Veeam-Get-Creds.ps1 script — a technique previously associated with ransomware actors targeting backup infrastructure. On day 20, data was exfiltrated from a file server via a renamed Rclone binary over FTP.

Despite nearly two months of intermittent C2 access, extensive AD reconnaissance, and access to domain controllers and backup systems, no ransomware was deployed before the actor was evicted. The report ties the initial JavaScript sample to the broader Latrodectus/Brute Ratel tax-themed phishing campaign documented by Trustwave and Rapid7 following the Operation Endgame botnet takedowns in May 2024.

Source reporting: https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion