Lunar Spider JS dropper enables 58-day intrusion

A tax-themed JavaScript file attributed to Lunar Spider deployed Brute Ratel and Latrodectus, leading to a 58-day intrusion with credential theft, lateral movement, and data exfiltration via Rclone and FTP.

In May 2024, a user executed a malicious JavaScript file masquerading as a tax form (Form_W-9), attributed to the Lunar Spider initial access group. The heavily obfuscated file downloaded an MSI installer that deployed Brute Ratel via rundll32, which subsequently injected Latrodectus malware into explorer.exe. Within hours, the threat actor began reconnaissance using built-in Windows commands and established BackConnect VNC access. On day three, the actor discovered plaintext domain administrator credentials in an unattend.xml Windows Answer file left from an automated deployment process, providing immediate high-privilege domain access.

On day four, the threat actor deployed Cobalt Strike beacons, escalated privileges using the compromised domain admin account via runas, and conducted extensive Active Directory reconnaissance with AdFind. They used PsExec to laterally move Cobalt Strike to multiple systems including domain controllers, file servers, and backup servers. A custom .NET backdoor was deployed for persistence via scheduled task, and an attempted Zerologon exploit targeted a second domain controller. On day 20, the actor used Rclone and FTP to exfiltrate data from file servers over a 10-hour period. On day 26, they executed Veeam-Get-Creds.ps1 to harvest backup credentials and deployed rustscan for network scanning.

The threat actor maintained intermittent command and control access for nearly two months through multiple payloads including Latrodectus, Brute Ratel, Cobalt Strike, BackConnect, and a custom .NET backdoor. Despite comprehensive access to critical infrastructure and extended dwell time, no ransomware deployment was observed before the actor was evicted from the environment.

title: AdFind Execution for Active Directory Reconnaissance
id: 4a8c7aac-0fb7-5052-9d6d-be6089d46a3b
status: experimental
description: 'Detects execution of AdFind.exe (or a renamed copy) using command-line
  switches commonly used

  for domain object, group, trust, and computer enumeration. Seen used by intrusion
  actors after

  gaining domain admin credentials to perform extensive Active Directory reconnaissance.

  '
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
  - Image|endswith: \AdFind.exe
  - OriginalFileName: AdFind.exe
  selection_switches:
    CommandLine|contains:
    - -sc trustdmp
    - -sc admincountdmp
    - -f "objectcategory="
    - -subnets
    - -gcb
    - -users
    - -computers_pwnotreqd
  condition: selection_image and selection_switches
falsepositives:
- Legitimate AD administration or auditing scripts that use AdFind for inventory purposes
- Security tooling / vulnerability scanners bundled with AdFind for compliance checks
level: high
tags:
- attack.discovery
- attack.t1087.002
- attack.t1482
- attack.t1069.002
author: Vorant

title: Rundll32 Spawned by Msiexec Loading DLL With Export Argument
id: 446b748d-de8e-56d4-8617-b3a5966b7608
status: experimental
description: 'Detects rundll32.exe being spawned directly by msiexec.exe with a command
  line that references

  a DLL path and export function argument. This pattern matches MSI installers used
  to drop and

  execute post-exploitation loaders (observed with Brute Ratel) shortly after a user
  runs an

  MSI package, often following a JavaScript dropper stage.

  '
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \msiexec.exe
  selection_child:
    Image|endswith: \rundll32.exe
  selection_cmdline:
    CommandLine|re: .*\.dll\s*,\s*\w+.*
  filter_common:
    CommandLine|contains:
    - \System32\
    - DllRegisterServer
  condition: selection_parent and selection_child and selection_cmdline and not filter_common
falsepositives:
- Legitimate software installers that call rundll32 to register COM components as
  part of setup
- Enterprise deployment tools that chain msiexec to rundll32 for configuration tasks
level: high
tags:
- attack.defense_evasion
- attack.execution
- attack.t1218.011
- attack.t1055
author: Vorant

title: Rclone Execution Indicative of Cloud Storage Exfiltration
id: afa0bd76-a31c-5f53-bd54-08bc3af26915
status: experimental
description: 'Detects execution of rclone.exe (including renamed binaries) with command-line
  arguments

  indicating a sync or copy operation combined with a remote/config flag, consistent
  with

  exfiltration of data from file servers to cloud storage over an extended period
  as observed

  in extended dwell-time intrusions.

  '
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
  - Image|endswith: \rclone.exe
  - OriginalFileName: rclone.exe
  selection_action:
    CommandLine|contains:
    - ' sync '
    - ' copy '
  selection_flags:
    CommandLine|contains:
    - --config
    - --min-age
    - --transfers
    - --include
    - --progress
  condition: selection_image and selection_action and selection_flags
falsepositives:
- Legitimate backup or data-sync operations performed by IT staff using rclone for
  cloud storage migrations
- Scheduled business continuity jobs that intentionally replicate file server content
  to approved cloud storage
level: medium
tags:
- attack.exfiltration
- attack.t1567.002
- attack.t1570
- attack.t1071.002
author: Vorant

Source reporting: https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion