INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
ATTENTION: This report is based on previous data. New intelligence sources have been linked and the Executive Summary and Mitigations need to be re-synthesized.

Lunex Uses BYOVD to Deploy Persistent Stealer Against Russian Companies

| 2026-10-08 02:02 LOW HIGH RANSOMWARE & EXTORTION MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
On October 6, 2026, the Lunex Malware-as-a-Service platform targeted Ukrainian users through fake CAPTCHA lures, exploiting AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products. The attack affected seven Chromium-based browsers and multiple cryptocurrency wallets, with a total of 7 countries being targeted in Ukraine. The attackers used the BYOVD technique to manipulate security controls, deploying LunexStealer to harvest credentials while establishing persistent C2 access through registry keys, scheduled tasks, and Native Messaging Host registrations. This mechanism survives deletion of the primary executable, providing continued filesystem access and remote execution capabilities.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2023-20598 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Technical Observables
teamwork-recover-password.com
blog.polyswarm.io
lxrrxl.ydns.eu
uasputnik.com
whatsappbusineses.com
ibraq-perfumes.com
account-sams-club.com
namshi-uae.com
www.ontinue.com
91.92.34.243
185.207.15.147
31.76.103.132
194.165.16.55
94.154.32.21
217.64.151.119
217.77.15.181
87.120.104.147
193.178.159.128
103.101.85.123
94.158.247.238
30d67de37f43a96fdbda6e3a97ad8964f5b4c136
f48c7c8bf055b1cde6265e875c9c245e4b6ca828
ae5292a44abb8faefa9d26a1ca9dd23e69c0d272
f329ae0fdf1e198bea6ba787e59cb73f90714002
85e01bdb2aee0217932e108535691c898b138a80
021780301b05e70267f58dbacc2ccbc3c858a8cc
1e6ea5c6c4401476638d5446ad1cbd07eb6c617d
1219b0d448484d114873ea36d54ec141e41a7866
bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8
6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
e9745f1791b2a6374711756e89c7bf2864e52f9ff467974f2f7bdc667f9f28c6
35f21ee165d26ab28ef286fe67d6d0c27e67277173a514334d19a27996c05278
06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90
41ff3ecd1458b0bf86e1b4891636213e
ae5450f32bcb533c5b592c77a7861553
3f4c9025125027e307b7e52dd577303b
b96d75a000367c200958089728fc5cb8
293256dbba3ad1ac3a2790133c4ee9a4
7de76bc6dbd2ac863f6f96172e49e1fa
b53e3b3607b3a7f4459abc0bb445dd36
c27f32b3281c015ddd122f6b1c594c58
4e933195e2026c1900a8db779ac9e302
5d3cbfb3a4949baffcea87a56afd6171
fe6f183dd83b307139557cd5462782a2
62269c1cd1394d6fac0a26b7fcc0b0ef
348cabe85c8bb40e690ab873ab94acac
7120957996e3016459a99268c8f4ddf4
67090913f499f018e7e9cddd002f0307
5b1ecb218f51730dca6a4efdd022fd02
4bd8ec4549b653a79162c6e169231079
https://www.ontinue.com/resource/lunex-unmasked-a-new-information-stealer-deployed-through-byovd
https://blog.polyswarm.io/lunex-uses-byovd-to-disable-security-monitoring-and-deploy-persistent-stealer
msiexec.exe
spkvol.dll
FnHotkeyUtility.exe
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2023-20598CVE-2023-20598
Target & Sectors
BENELUX BENELUX CENTRAL_ASIA CENTRAL_ASIA DACH DACH cryptocurrencycryptocurrency retailretail logisticslogistics manufacturingmanufacturing
Incident Timeline
‎March 2026
Microsoft's Vulnerable Driver Blocklist failed to prevent the loading of a specific PDFWKRNL.sys variant, which was previously catalogued in the LOLDrivers project since March 2026.
organisation Microsoft
"Validated testing demonstrated that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading, a gap that persists despite the driver hash being catalogued in the LOLDrivers project since March 2026."
organisation LOLDrivers
"Validated testing demonstrated that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading, a gap that persists despite the driver hash being catalogued in the LOLDrivers project since March 2026."
‎June 2026
Threat actors used Lunex Stealer's command-and-control panels to target multiple countries, including Ukraine and Russia.
target_region Ukraine
The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when BlueTeamCoolTeam's Luke Wilkinson identified six active Lunex Stealer's command-and-control (C2) panels across the U.S., Finland, Germany, the Netherlands, and Ukraine.
source_region Finland
The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when BlueTeamCoolTeam's Luke Wilkinson identified six active Lunex Stealer's command-and-control (C2) panels across the U.S., Finland, Germany, the Netherlands, and Ukraine.
source_region Germany
The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when BlueTeamCoolTeam's Luke Wilkinson identified six active Lunex Stealer's command-and-control (C2) panels across the U.S., Finland, Germany, the Netherlands, and Ukraine.
target_region Netherlands
The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when BlueTeamCoolTeam's Luke Wilkinson identified six active Lunex Stealer's command-and-control (C2) panels across the U.S., Finland, Germany, the Netherlands, and Ukraine.
general_metric 28 panels
Analysis of the Lunex panel points to a Russian-speaking developer or development team, with 28 unique panels identified across 13 countries, marking a major expansion from June 2026.
general_metric 13 countries
Analysis of the Lunex panel points to a Russian-speaking developer or development team, with 28 unique panels identified across 13 countries, marking a major expansion from June 2026.
source_region Russian Federation
Analysis of the Lunex panel points to a Russian-speaking developer or development team, with 28 unique panels identified across 13 countries, marking a major expansion from June 2026.
organisation Analysis of the
Analysis of the Lunex panel points to a Russian-speaking developer or development team, with 28 unique panels identified across 13 countries, marking a major expansion from June 2026.
‎2026/10/06
Threat actors used a vulnerable AMD Radeon Software driver (CVE-2023-20598) to escalate privileges and blind security-related processes, then deployed the LunexStealer malware through compromised websites using ClickFix-style Cloudflare verification checks.
organisation The Lunex
The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products.
organisation CAPTCHA
The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products.
A sophisticated four-stage attack chain delivers the Lunex information stealer to Ukrainian-speaking users through fake CAPTCHA pages.
"The attack chain begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent," Ontinue threat researcher Rhys Downing said in a technical report.
organisation AMD
The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products.
The malware employs Bring Your Own Vulnerable Driver (BYOVD) techniques using AMD's PDFWKRNL.sys to disable kernel-level security monitoring before deploying the final payload.
organisation ClickFix
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex .
organisation Cloudflare
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex .
organisation CVE-2023-20598
Lunex takes advantage of a vulnerable kernel-mode driver for AMD Radeon Software ("PDFWKRNL.sys"), which is susceptible to CVE-2023-20598 , to escalate privileges and blind security-related processes while keeping them running.
organisation Lunex
Lunex takes advantage of a vulnerable kernel-mode driver for AMD Radeon Software ("PDFWKRNL.sys"), which is susceptible to CVE-2023-20598 , to escalate privileges and blind security-related processes while keeping them running.
organisation AMD Radeon
Lunex takes advantage of a vulnerable kernel-mode driver for AMD Radeon Software ("PDFWKRNL.sys"), which is susceptible to CVE-2023-20598 , to escalate privileges and blind security-related processes while keeping them running.
infrastructure Windows
The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the technique version-agnostic.
The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver ( BYOVD ) attack for defense evasion, and finally download the stealer payload.
organisation Microsoft
The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the technique version-agnostic.
organisation MSI
The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver ( BYOVD ) attack for defense evasion, and finally download the stealer payload.
organisation LunexLoader
The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver ( BYOVD ) attack for defense evasion, and finally download the stealer payload.
organisation User Account Control
The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver ( BYOVD ) attack for defense evasion, and finally download the stealer payload.
organisation Lunex Uses
Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer.
organisation Disable Security Monitoring and
Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer.
organisation LunexStealer
After manipulating security controls, LunexStealer is deployed to harvest credentials from seven Chromium-based browsers and multiple cryptocurrency wallets while establishing persistent C2 access through registry keys, scheduled tasks, and Native Messaging Host registrations.
LunexStealer (aka Psychedelic Stealer) C2 Panel | Source: BlueTeamCoolTeam It's worth noting that both Psychedelic Stealer and LunexStealer refer to the same component of the MaaS platform.
organisation Chromium
After manipulating security controls, LunexStealer is deployed to harvest credentials from seven Chromium-based browsers and multiple cryptocurrency wallets while establishing persistent C2 access through registry keys, scheduled tasks, and Native Messaging Host registrations.
The stealer targets seven Chromium-based browsers, extracts credentials using custom SQLite parsers, exfiltrates cryptocurrency wallets, and establishes persistent access through PowerShell-based Chrome Native Messaging Hosts that survive binary deletion.
"The stealer extracts credentials and data from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access through a PowerShell-based Native Messaging Host installed within the victim's browser.
organisation C2 Panel
LunexStealer (aka Psychedelic Stealer) C2 Panel | Source: BlueTeamCoolTeam It's worth noting that both Psychedelic Stealer and LunexStealer refer to the same component of the MaaS platform.
organisation SQLite
The stealer targets seven Chromium-based browsers, extracts credentials using custom SQLite parsers, exfiltrates cryptocurrency wallets, and establishes persistent access through PowerShell-based Chrome Native Messaging Hosts that survive binary deletion.
organisation Native Messaging Host
"The stealer extracts credentials and data from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access through a PowerShell-based Native Messaging Host installed within the victim's browser.
organisation PDB
The Lunex platform operates 28 command-and-control panels across 13 countries, features Russian-language operator interfaces, and demonstrates advanced engineering including PDB-guided kernel callback zeroing, custom encryption implementations, and direct syscall invocation.
"The BYOVD delivery chain, using PDB-guided kernel callback zeroing rather than process termination, represents a quieter approach to EDR neutralisation that leaves security products running but blind," Ontinue said.
data_breach 2026 September
LxBase RAT observed for the first time in attacks against Russian companies.. From July through September 2026, threat actors conducted mass phishing campaigns against Russian organizations in finance, engineering, manufacturing, energy, retail, agriculture, logistics, construction, and IT.
organisation BYOVD
"The BYOVD delivery chain, using PDB-guided kernel callback zeroing rather than process termination, represents a quieter approach to EDR neutralisation that leaves security products running but blind," Ontinue said.
organisation EDR
"The BYOVD delivery chain, using PDB-guided kernel callback zeroing rather than process termination, represents a quieter approach to EDR neutralisation that leaves security products running but blind," Ontinue said.
organisation Lunex Unmasked
Lunex Unmasked: A New Information Stealer Deployed Through BYOVD.
data_breach 13,200 byte
"The host is backed by a 13,200-byte PowerShell script embedded in the .rdata section that implements the Chrome Native Messaging protocol over standard input and output," Downing said.
organisation RAR
Attachments were RAR archives disguised with a `.tar` extension and contained obfuscated JavaScript loaders.
organisation Disable Security Monitoring and Steal Browser
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials.
organisation Google Chrome
Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft - Steal credentials from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi.
organisation Microsoft Edge, Brave
Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft - Steal credentials from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi.
organisation Opera GX
Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft - Steal credentials from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi.
organisation NMH
Establish persistence using a Registry Run key, a hidden scheduled task named "psychedelicloveUtils," and register a Chrome native-messaging bridge or host (NMH) that allows the stealer to perform additional actions.
organisation Chrome Secure Preferences
…write , to write arbitrary data to any file path download , to download files from the system run , to execute arbitrary programs What's more, LunexStealer injects a malicious Chrome extension by manipulating Chrome Secure Preferences and declares extensive permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs.
data_breach 524 MB write
" The PowerShell script supports six file system actions - list_drives , to enumerate all drive letters C through Z list_dir , to list directory contents with file sizes read_file , to read arbitrary files in 512 KB chunks and those up to 524 MB write , to write arbitrary data to any file path download , to download files from the system run , to execute arbitrary programs Wha…
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
In Mode 2, the bogus verification page is shown only to Windows users who arrive at the site from search engine results and not more than twice in 12 hours.
Variant 2 , which attempts to bypass Windows account control (UAC), configures Microsoft Defender exclusions, leverages the legitimate-but-vulnerable AMD driver ("PDFWKRNL.sys") to blind security software, and then retrieves and runs LunexStealer from a remote server.
Its primary responsibility is to provide LUNARAXE with access to the Windows file system through a PowerShell-based Native Messaging Host.
CERT-UA is advising organizations to prohibit regular users from using the Windows Run dialog via group policies, restrict the installation of MSI packages by users without administrator rights, monitor for the execution of "msiexec.exe," enable blocking of vulnerable drivers via Microsoft's vulnerable driver blocklist, and limit the installation of browser extensions to allowlisted ones.
The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the technique version-agnostic.
The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver ( BYOVD ) attack for defense evasion, and finally download the stealer payload.
Metrics
infrastructure
‎Microsoft Office
Affected Product
The extension masquerades as "Microsoft Office Word Editor" to steal cookies, browsing history, and credentials entered into web forms.
Metrics
data_breach
2,026
September
LxBase RAT observed for the first time in attacks against Russian companies.. From July through September 2026, threat actors conducted mass phishing campaigns against Russian organizations in finance, engineering, manufacturing, energy, retail, agriculture, logistics, construction, and IT.
Metrics
data_breach
13,200
Byte
"The host is backed by a 13,200-byte PowerShell script embedded in the .rdata section that implements the Chrome Native Messaging protocol over standard input and output," Downing said.
Metrics
data_breach
524
Mb Write
" The PowerShell script supports six file system actions - list_drives , to enumerate all drive letters C through Z list_dir , to list directory contents with file sizes read_file , to read arbitrary files in 512 KB chunks and those up to 524 MB write , to write arbitrary data to any file path download , to download files from the system run , to execute arbitrary programs Wha…
Intelligence Sources
The Hacker News 2026-09-26
AlienVault OTX 2026-09-26
AlienVault OTX 2026-09-30
AlienVault OTX 2026-10-06
The Hacker News 2026-10-07
Ransomware Live 2026-10-08