Ontinue’s Cyber Defense Centre recently discovered and reverse-engineered an attack using the Lunex Malware-as-a-Service (MaaS) platform. During this attack chain, EDR agents run normally, and dashboards appear green, all while the attacker is inside the system. This research is Ontinue’s first public binary analysis of Lunex tooling. The stealer binary analyzed in this publication was compiled on September 12th, with infrastructure supporting it installed days prior. Ontinue’s analysis of the attack chain highlights the crucial question of what happens when enterprises place implicit trust in silent tools.
It Starts With Proving You're Human
The attack chain analyzed begins with a fake CAPTCHA lure aimed at Ukrainian-speaking users. This page directs the targeted users to paste an msiexec command, with MSI hidden from Add/Remove Programs, so administrator rights are not required. The MSI also contains a built-in upgrade path to re-arm previously compromised systems and update the payload.
From Standard User to Kernel Without a Prompt
Every operational string in the attack—API names, file paths, registry keys, WMI queries, C2 URLs, process names, and kernel symbol names—is hidden with AES-256 encryption. Only a few pieces of information are produced by running strings on the Loader: import table names, API references, and a payload.exe plaintext string.
The attacker achieves privilege escalation through a Process Environment Block masquerade posing as a trusted Windows binary in order to auto-elevate the CMSTPLUA COM object and bypass UAC prompting for Administrator privileges. With driver-loading privilege enabled, the attack moves on to obtain kernel access next.
Using Microsoft's Symbol Server Against Windows
The loader extracts an RSDS PDB GUID that is unique to the Windows kernel build of the victim’s device. The Kernel PDB is fetched with a spoofed symbol-server user agent. This creates traffic that is indistinguishable from routine debugging activity, appearing innocuous and legitimate.
The exact structure of the technique stores offsets in global variables which are used to find kernel callback tables, notification chains, and process structure fields. This works on all Windows 10 and Windows 11 builds.
Twenty Security Drivers Silenced Mid-Watch
The next stage of the attack is Bring Your Own Vulnerable Driver (BYOVD) abuse. “Like many attack vectors, exploiting trust is the foundation of this entire attack,” says John Gallagher, Vice President at Viakoo, a Mountain View, Calif.-based provider of automated OT and IoT cyber hygiene. “The whole ‘bring your own vulnerable driver’ approach relies on abusing Windows' Driver Signature Enforcement to have the OS blindly trust the driver.”
The encrypted payload was found in AMD’s PDFWKRNL.sys driver, with a signed binary compiled consistently with the device build. The flaw, tracked as CVE-2023-20598, comes from poorly designed IOCTLs with zero access controls. This campaign takes advantage of the vulnerability, granting full access to all operations in order to ensure that callbacks for Defender, CrowdStrike, SentinelOne, Kaspersky, and ESET are zeroed. The attacker also targets Windows Filter Manager (fltMgr.sys) to simultaneously blind all security products that rely on minifilters.
This kind of behavior on the compromised device is a major indicator of malicious activity. “Tools like these almost always try to enumerate running processes to find security tools that can detect them,” according to John Bambenek, President at Bambenek Consulting. “I have found that it is a strong EDR signal to look for this relatively easy-to-spot behavior to block the executable early in the attack lifecycle so remediation can be done.”
Harvesting Browsers and Wallets in the Dark
The attack chain harvests credentials and other sensitive data from seven different Chromium-powered browsers, including Yandex and Opera GX. The encryption key extraction method works on Chrome v10, v11 App-Bound, and v20 encryption, whereas most other publicly documented stealers are only able to handle up to version 11.
The stealer payload zips and exfiltrates data from five desktop cryptocurrency wallets and four browser extension wallets. The attack evades signature-based threat detection measures by leveraging custom SQLite, JSON, and ZIP codes.
The Backdoor That Survives Removal
One of the most notable factors in this attack chain is its ability to maintain a presence that persists and can be renewed even after the payload is removed from the compromised device. The attack uses the expected layers of a registry Run key and a hidden task scheduled to execute on user login. However, it also leverages a third persistence channel by registering a Native Messaging Host in Chrome and Edge.
This mechanism, which allows legitimate browser extensions to communicate with applications native to the device, enables stubborn persistence. The attack creates a PowerShell backdoor with the capability to read, write, download, and execute, granting the attacker significant levels of access and control. Incomplete cleanup of all of these areas during remediation can leave attackers with full filesystem access, while victims believe they are free of the attack.
Built by Russian Speakers, Rented to Anyone
While BlueTeamCoolTeam documented six Lunex panels in June 2026, Ontinue’s scanning discovered 28 unique panels across 13 countries—including Russia, the USA, the UK, and a handful of other European and Asian countries—demonstrating significant growth. The UI of the MaaS is in Russian by default, featuring a ya.ru placeholder in the browser spoofing process and hosted in the Moscow region.
One panel based in Turkey has been tied to five phishing domains targeting brands including Sam’s Club and WhatsApp. The deployment of this attack chain hints at an elite developer paired with subpar infrastructure security in action, such as lacking TLS and leaving phpMyAdmin exposed. This shows the spread of the Lunex MaaS far beyond its creators.
The Guardrails That Didn't Hold
Safeguards set in place to protect against attacks like this were unable to stop this attack chain. HVCI and Microsoft’s current Vulnerable Driver Blocklist both failed to catch and block this driver variant. This gap continues to present challenges, although the driver hash has been in LOLDrivers since March 2026. While the Chrome integrity bypass used in Lunex attacks at first implied the possibility of nation-state involvement, the bypass is now too commonly used by threat actors to rely on as a signal.
Catching the Attack Before the Lights Go Out
Keeping an eye out for the indicators of compromise associated with this campaign will help to tell if your systems have been compromised. Protecting against attacks like this in advance demands taking specific steps to ensure defenses against sophisticated threat action. Detection measures should watch for things that EDR often misses, including PDB downloads from non-development processes and driver drops to temporary paths and new driver services. Hunting for the com.lunex.explorer Native Messaging Host key can identify persistence channels for removal. This attack campaign underlines the fact that silence from EDR tools should be treated as unverified, not accepted as proof of security.
