LunexStealer Abuses AMD Driver BYOVD to Blind EDR and Steal Credentials

Executive Summary

Ontinue's Cyber Defence Centre has reverse-engineered a four-stage attack chain operated through the Lunex Malware-as-a-Service platform, targeting Ukrainian-speaking users via fake CAPTCHA lure pages. The campaign deploys LunexStealer, a 281 KB MinGW-w64 infostealer compiled on 12 September 2026, preceded by a Bring Your Own Vulnerable Driver (BYOVD) chain that abuses AMD's PDFWKRNL.sys (CVE-2023-20598) to zero kernel security callbacks.

The BYOVD stage does not terminate security products. It leaves EDR processes running but blind by zeroing PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine callback entries. The loader resolves exact kernel offsets by downloading the target machine's PDB symbols from Microsoft's Symbol Server, making the technique version-agnostic across all Windows 10 and Windows 11 builds.

Internet-wide scanning identified 28 Lunex C2 panels across 13 countries, a significant expansion from the six panels documented in prior OSINT research. Panel source code analysis revealed Russian-language operator UI strings, banking trojan capabilities, and a self-registration endpoint confirming the platform serves multiple independent criminal operators.

Technical Vulnerability Analysis & Attack Chain

Stage 1: Initial Access via Fake CAPTCHA (ClickFix)

• Delivery Domain: uasputnik[.]com hosted on shared infrastructure in Warsaw, Poland
• Lure: Ukrainian-language fake CAPTCHA page instructs victims to execute an msiexec command
• Payload: Silently installs elita.msi from the attacker's URL with no user interaction

Stage 2: MSI Installer (elita.msi)

• Format: 1.1 MB unsigned OLE Compound Document
• Product Name: "Vertification" by "Internal Software" (deliberate misspelling matching Ukrainian lure text)
• Stealth Properties: LIMITUI=1 suppresses Windows Installer wizard; ARPNOMODIFY=1 and ARPNOREPAIR=1 hide from Add/Remove Programs
• Installation Path: %LOCALAPPDATA%\Programs\Internal Software\Vertification\ (per-user, no UAC elevation required)
• Auto-Launch: Type 226 Custom Action at sequence 6700 fires after InstallFinalize, launching the loader binary
• Update Mechanism: Upgrade table with UpgradeCode {2F40B8FA-6CB2-4328-B2A3-4B15A124F441} enables remote payload updates via new MSI distribution

Stage 3: Loader / Dropper (config.exe / psychedelic.exe)

• Binary: 2.3 MB 64-bit MinGW-w64 executable spoofing Canonical Ltd.'s "Update Manager"
• Obfuscation: All 126 operational strings AES-256-CTR encrypted; dead-code IAT anchor with GetTickCount() == 0x9E3779B9 (mathematically impossible) inflates Import Address Table with 55 decoy API entries across 12 DLLs
• UAC Bypass Chain:
  1. PEB masquerade: overwrites ImagePathName, CommandLine, and InMemoryOrderModuleList with Windows system path
  2. COM Elevation Moniker: CoGetObject with CMSTPLUA CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} for auto-elevation
  3. Token privilege: AdjustTokenPrivileges enables SeLoadDriverPrivilege
  4. Driver deployment: CreateServiceA + StartServiceA loads BYOVD
• Evasion: WMI sandbox/VM detection with 16 encrypted property names; process enumeration against 20-entry AES-encrypted security driver blocklist

Stage 4: PDB-Guided Kernel Symbol Resolution

• Technique: Reads ntoskrnl.exe RSDS PDB GUID, spawns curl.exe to download ntkrnlmp.pdb from Microsoft Symbol Server
• Spoofed User-Agent: Microsoft-Symbol-Server/10.1700.661.0 mimics legitimate Windows symbol resolution
• Symbol Resolution: Parses PDB with 8 dbghelp.dll APIs (SymInitialize, SymLoadModuleEx, SymFromName, SymGetTypeInfo, etc.) to resolve 15 kernel symbols including PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, PspLoadImageNotifyRoutine, ActiveProcessLinks, Token, Protection, SignatureLevel, CallbackListHead
• Impact: Version-agnostic across all Windows 10/11 builds because offsets are always exact for the running kernel

Stage 5: BYOVD Abuse (AMD PDFWKRNL.sys, CVE-2023-20598)

• Driver: AMD USB-C Power Delivery Firmware Update Utility Driver, validly Authenticode-signed through AMD -> Sectigo -> USERTrust -> Microsoft Code Verification Root
• Payload Extraction: 2 MB AES-256-GCM encrypted overlay (91% of loader file size), authentication tag bd8edd25bcf7717b
• Vulnerability: 12 IOCTL control codes with zero access controls on \\.\PdFwKrnl device
  • IOCTL 0x80002028: Arbitrary kernel-to-user memory read
  • IOCTL 0x80002014: Arbitrary user-to-kernel memory write
• Callback Zeroing: Reads callback table contents via read IOCTL, resolves owning module via K32GetDeviceDriverBaseNameA, checks against 20-entry blocklist, zeroes matching entries via write IOCTL
• Result: EDR products remain running but are completely blind to process creation, thread creation, and image loading

Stage 6: LunexStealer Deployment

• Download: http://107.175[.]82[.]242:9000/wilow/psychedeliclove.exe
• Binary: 281 KB 64-bit MinGW-w64, compiled 12 September 2026, 169 imports across 11 DLLs
• Browser Targets: Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, Vivaldi
• Encryption Handling: Chrome v10 (AES-GCM + DPAPI), v11 (App-Bound Encryption via IElevator COM injection), v20 (ChaCha20-Poly1305)
• Crypto Wallets: Bitcoin Core, Litecoin, Exodus, Atomic Wallet, Electrum (desktop); MetaMask, MetaMask Legacy, OKX Wallet, SafePal (browser extensions)
• Custom Internals: FNV-1a hash-based API resolution, direct syscalls from ntdll.dll, hand-written JSON parser, custom SQLite B-tree page reader, ZIP builder with raw PK headers

Stage 7: Persistence & C2

• Registry Run Key: UserStarts <path> at user logon
• Scheduled Task: psychedelicloveUtils via Task Scheduler COM interface
• Chrome Native Messaging Host: com.lunex.explorer (+ Edge equivalent) backed by 13,200-byte embedded PowerShell script with 6 filesystem actions; survives binary deletion, reboots, and browser restarts
• Chrome Extension Injection: HMAC bypass of Chrome Secure Preferences, enables developer mode, injects extension with permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, all URLs
• C2 Protocol: HTTP to 193.178.159[.]128:8080 with X-API-Key header authentication; structured flow: checkin -> config -> fingerprinting (17 fields) -> kill switch check -> credential theft -> exfil -> task polling with randomized heartbeat
• Mutex: Local\psychedeliclove-guard

20-Driver EDR Blocklist

The AES-256-CTR encrypted blocklist targets security products from 9 vendors:

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Platform: Lunex Malware-as-a-Service (MaaS)

Developer Attribution: Russian-speaking developer or development team. The panel frontend (React SPA) contains 150+ Russian-language UI strings loaded via i18next as the default locale. Placeholder configuration uses "ya.ru" (Yandex Russia homepage). The language selector lists "Pycckuu" as the primary option. The highest concentration of panels (6 of 28) is hosted on UFO Technologies in Krasnogorsk (Moscow region).

Operator in This Campaign: Tagged "Psychedelic" in the stealer configuration. Targeted Ukrainian-speaking users via fake CAPTCHA on uasputnik[.]com. Delivery domain co-located with a domain using the Russian word "Vostok" (East) on shared hosting in Warsaw, Poland.

Infrastructure Scope: 28 unique Lunex C2 panels across 13 countries (Russia 6, United States 4, United Kingdom 3, Netherlands 2, France 2, Germany 2, Turkey 2, Bangladesh 2, others). One Turkey-based panel (103.101.85[.]123) resolves to 5 phishing domains including account-sams-club[.]com and whatsappbusineses[.]com, confirming brand impersonation alongside credential theft.

Developer vs Operator Gap: Advanced malware engineering (custom AES-256, PDB-guided kernel resolution, dead-code IAT anchor) contrasts with poor infrastructure OPSEC (no TLS, phpMyAdmin exposed with root MySQL access, wildcard CORS headers). This disconnect suggests separate developer and operator roles.

Platform Maturity: Multiple stealer codebases (Rust, C, .NET) connect to the same panel architecture. Self-registration endpoint and 28 identified panels confirm a commercial MaaS platform, not a single-operator malware family.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• WDAC Driver Block: Deploy a Windows Defender Application Control (WDAC) policy blocking PDFWKRNL.sys by Authentihash SHA-256: fc23abdcf93928e1db8401a7ff53c86c85230a8637c4168f7434208f9e8b5ded. File hash-based rules are insufficient because Authenticode-signed drivers can have varying file hashes.
• Microsoft Vulnerable Driver Blocklist: Validated testing by Ontinue confirmed the current MVDB does not block this specific PDFWKRNL.sys variant despite the hash being catalogued in LOLDrivers since March 2026. Request Microsoft expedite blocklist inclusion.
• HVCI: Hypervisor-protected Code Integrity does not prevent this driver from loading because the Authenticode signature remains valid.
• Native Messaging Host Audit: Enumerate all Chrome/Edge NMH registrations at HKCU\Software\Google\Chrome\NativeMessagingHosts\ and HKCU\Software\Microsoft\Edge\NativeMessagingHosts\. Alert on any entry containing com.lunex.explorer.
• Chrome Extension Audit: Review chrome://extensions for unlisted extensions with broad permissions (cookies, history, declarativeNetRequest, all URLs) enabled via developer mode.

2. Network & Perimeter Defenses

• Block C2 Infrastructure:
  • 107.175.82[.]242 (payload server, port 9000)
  • 193.178.159[.]128 (exfil API port 8080, panel port 8000, phpMyAdmin port 8081)
  • uasputnik[.]com (delivery domain)
• Alert on PDB Downloads from Non-Developer Processes: Flag curl.exe command lines containing msdl.microsoft.com/download/symbols/ntkrnlmp.pdb originating from non-development executables. Do NOT block the Microsoft Symbol Server domain.
• API Key Detection: Alert on HTTP requests containing X-API-Key: c9daf8dbafc5e1f63e4af742a14a8a6669365e106ab0247ab366621bbc1f6967
• User-Agent Anomaly: Flag Microsoft-Symbol-Server/10.1700.661.0 User-Agent from processes other than Visual Studio or WinDbg.

3. Endpoint Detection & Hunting Query

title: LunexStealer BYOVD Driver Load and PDB Download
id: 8f2d1c3a-6e4b-4a9f-b7c8-d5e3f1a2b4c6
status: experimental
date: 2026/09/27
author: CyberNewsAI Threat Intelligence
description: Detects AMD PDFWKRNL.sys BYOVD driver loading or PDB symbol download by non-developer process indicative of LunexStealer kernel callback zeroing
references:
  - https://www.ontinue.com/resource/lunex-unmasked-a-new-information-stealer-deployed-through-byovd/
  - https://cybernewsai.com/blog/lunex-stealer-amd-byovd-edr-evasion
logsource:
  category: driver_load
  product: windows
detection:
  selection_driver:
    ImageLoaded|endswith: '\\PDFWKRNL.sys'
  selection_service:
    EventType: 'CreateService'
    ServiceFileName|contains: 'PDFWKRNL'
  selection_pdb_download:
    ParentImage|endswith:
      - '\\config.exe'
      - '\\psychedelic.exe'
    Image|endswith: '\\curl.exe'
    CommandLine|contains: 'msdl.microsoft.com/download/symbols/ntkrnlmp.pdb'
  selection_nmh_registry:
    TargetObject|contains: 'NativeMessagingHosts\\com.lunex.explorer'
  condition: selection_driver or selection_service or selection_pdb_download or selection_nmh_registry
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1068
  - attack.persistence
  - attack.t1176
falsepositives:
  - Legitimate AMD driver installations (validate certificate chain and file path)

// Microsoft Sentinel / Defender - LunexStealer BYOVD and Persistence Hunting
let LunexDriverHashes = dynamic(["6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1", "bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8", "06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90", "38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878"]);
let LunexC2IPs = dynamic(["107.175.82.242", "193.178.159.128"]);
// Driver load detection
DeviceEvents
| where ActionType == "DriverLoad" and (FileName =~ "PDFWKRNL.sys" or SHA256 in (LunexDriverHashes))
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| union (
    // PDB download by non-developer process
    DeviceProcessEvents
    | where FileName =~ "curl.exe" and ProcessCommandLine has "ntkrnlmp.pdb" and ProcessCommandLine has "msdl.microsoft.com"
    | where InitiatingProcessFileName !in~ ("devenv.exe", "windbg.exe", "vshost.exe")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
)
| union (
    // NMH persistence registry key
    DeviceRegistryEvents
    | where RegistryKey has "NativeMessagingHosts" and RegistryKey has "com.lunex.explorer"
    | project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName
)
| union (
    // C2 network connections
    DeviceNetworkEvents
    | where RemoteIP in (LunexC2IPs) or RemoteUrl has "uasputnik.com"
    | project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
)
| sort by Timestamp desc

SHA-256 File Hashes

C2 Infrastructure

Persistence Indicators

API Endpoints & Authentication