Actor Profile

Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryptocurrency wallet exfiltration, and persistent remote filesystem access. First documented in June 2026, Lunex has rapidly expanded from 6 to 28 unique C2 panels across 13 countries including Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh. The platform's feature set extends beyond credential theft to include brand impersonation and phishing capabilities, as evidenced by phishing domains targeting Sam's Club, Namshi UAE, and WhatsApp Business.

TTPs (Tactics, Techniques, Procedures)

The attack chain employs a four-stage delivery mechanism beginning with ClickFix-style fake CAPTCHA pages on compromised Ukrainian websites. Initial access leverages bogus MSI installers that deploy LunexLoader, which bypasses UAC via the CMSTPLUA COM object (T1548.002). The operation notably employs BYOVD (Bring Your Own Vulnerable Driver) technique (T1068) by exploiting a vulnerable AMD Radeon Software driver (PDFWKRNL.sys, CVE-2023-20598) to escalate privileges and disable security monitoring while keeping processes running (T1562.001). Persistence is achieved through Registry Run keys (T1547.001), hidden scheduled tasks named "psychedelicloveUtils" (T1053.005), and a Chrome native-messaging host backed by PowerShell (T1059.001). The stealer targets seven Chromium-based browsers for credential harvesting (T1555.003) and exfiltrates cryptocurrency wallets (T1005). A malicious Chrome extension is injected via manipulation of Chrome Secure Preferences, granting complete browser visibility and control (T1176). C2 communication occurs over HTTP to facilitate data exfiltration (T1041).

Targets & Patterns

Lunex primarily targets Ukrainian-speaking users in the technology and web services sectors. The threat actor compromises legitimate Ukrainian websites—including a hair-treatment clinic, scale-model manufacturer, specialist bookseller, psychological facility, tool retailer, and automotive retailer—to inject iframe elements serving ClickFix lures. This targeting pattern suggests a focus on Ukrainian entities and users, likely motivated by geopolitical factors given the Russian-speaking origin of the platform developers. The use of localized compromised websites and Ukrainian-language lures indicates deliberate victim profiling. Additionally, phishing domains identified on Turkey-hosted panels suggest broader targeting of international brands and services including Sam's Club, Namshi UAE, and WhatsApp Business, indicating the platform supports diverse criminal operations beyond the Ukrainian-focused campaigns.

Historical Context

Lunex was first referenced in cybersecurity literature in June 2026 when BlueTeamCoolTeam identified six active C2 panels across the U.S., Finland, Germany, the Netherlands, and Ukraine. By September 2026, the platform had expanded significantly to 28 unique panels across 13 countries, representing major growth in just three months. This rapid expansion indicates active development and either widespread adoption by multiple threat actors or aggressive distribution by a single operator. Psychedelic Stealer was first documented by Arctic Wolf Labs in September 2026, revealing the ClickFix-based delivery mechanism and website compromise tactics. The BYOVD technique employed by Lunex represents a relatively rare approach for information stealer operations, marking an evolution in stealer sophistication by incorporating kernel-level defense evasion typically associated with more advanced threat actors.

Defensive Recommendations

  • Monitor for exploitation of CVE-2023-20598 in AMD Radeon driver (PDFWKRNL.sys) and block loading of known vulnerable driver hashes via driver blocklists or Windows Defender Application Control policies
  • Detect UAC bypass via CMSTPLUA COM object (T1548.002) by monitoring for unusual COM object instantiation patterns and DllHost.exe spawning unexpected child processes
  • Hunt for Chrome Native Messaging Host persistence by auditing HKCU\Software\Google\Chrome\NativeMessagingHosts registry keys and validating legitimacy of registered PowerShell-based hosts
  • Implement detection for hidden scheduled tasks (T1053.005) by monitoring for task creation with hidden attributes and names matching patterns like 'psychedelicloveUtils'
  • Deploy behavioral detection for BYOVD attacks (T1068) by alerting on kernel driver loads from non-standard paths, especially when followed by security process manipulation or callback modifications
  • Monitor for manipulation of Chrome Secure Preferences files and unauthorized extension installations with excessive permissions (cookies, history, bookmarks, declarativeNetRequest across all URLs)

---

# Geopolitical Context

Geopolitical Context

The Lunex malware-as-a-service campaign represents a sophisticated cyber operation targeting Ukrainian-speaking populations through compromised domestic websites. The deliberate focus on Ukrainian infrastructure—including healthcare, retail, and cultural institutions—suggests an intent to exploit the country's ongoing vulnerability amid the Russia-Ukraine conflict. The use of Russian-language developer artifacts in the Lunex panel, combined with targeted attacks on Ukrainian users, is consistent with patterns observed in cyber operations that align with Russian strategic interests. However, the MaaS model complicates attribution, as the platform may be operated by financially motivated actors or sold to multiple threat groups with varying objectives. The campaign's timing and geographic focus occur within a broader context of sustained cyber pressure on Ukraine's digital ecosystem since 2022.

State Actor Alignment

Analysis of the Lunex command-and-control infrastructure reveals Russian-language interfaces and a developer profile consistent with Russian-speaking cybercriminal ecosystems. The platform's 28 identified panels span 13 countries, with hosting in Russia, the United States, the United Kingdom, Netherlands, France, Germany, Turkey, and Bangladesh. While the MaaS business model suggests profit-driven motives typical of organized cybercrime, the deliberate targeting of Ukrainian websites and Ukrainian-speaking users may indicate either direct state sponsorship or tacit tolerance by Russian authorities. The campaign does not appear to be subject to known Western sanctions frameworks targeting cyber actors, though the use of compromised infrastructure across NATO member states (U.S., U.K., France, Germany, Netherlands, Turkey) may warrant coordinated law enforcement attention. The operational pattern is consistent with cyber-enabled intelligence collection or preparatory network access operations, though definitive state linkage cannot be established from available technical evidence alone.

Business Impacty pro region

For Europe, the Lunex campaign underscores Ukraine's persistent role as both target and testing ground for advanced cyber threats. The compromise of civilian websites—including healthcare and retail sectors—demonstrates threat actors' willingness to weaponize trusted domestic infrastructure, eroding public confidence in digital services during wartime. The campaign's credential theft and persistent access capabilities pose spillover risks to European partners engaged with Ukrainian entities, particularly through supply chain exposure or compromised business communications. The hosting of C2 infrastructure across multiple EU member states (Finland, Germany, Netherlands, France) highlights gaps in collective cyber defense and the continued abuse of European hosting providers by malicious actors. Globally, the Lunex platform's expansion from 6 panels in June 2026 to 28 by September 2026 signals rapid commercialization and potential adoption by diverse threat actors beyond the initial operators. The inclusion of phishing domains targeting Middle Eastern brands (Namshi UAE, Ibraq Perfumes) and U.S. retailers (Sam's Club) suggests the platform's customer base extends beyond Ukraine-focused operations, indicating a broader threat to international e-commerce and digital trust ecosystems.

Forecast

If Lunex continues its current growth trajectory, the platform is likely to attract additional threat actors seeking turnkey credential theft and persistent access capabilities, potentially diversifying targets beyond Ukraine to include other Eastern European states and diaspora communities. Should Western law enforcement agencies coordinate takedown operations against identified C2 infrastructure in NATO member states, operators may migrate to hosting providers in jurisdictions with weaker cyber governance, such as those already observed in Bangladesh and Turkey. If the campaign's Ukrainian focus persists alongside Russian-language operational security, attribution pressure may increase, potentially triggering sanctions designations or public attribution by Ukrainian or allied governments. The exploitation of CVE-2023-20598 in AMD drivers may prompt vendor and regulatory responses, including accelerated driver revocation or enhanced kernel-mode driver signing requirements in Windows environments. If compromised Ukrainian websites remain unpatched, the ClickFix social engineering technique is likely to be adopted by additional threat actors, expanding its use beyond the current Lunex operators. Should the platform's phishing capabilities expand, multinational brands may face increased impersonation risks, particularly in regions with lower cybersecurity awareness and limited brand protection enforcement.