LunaMalware
ESXi encrypting ransomware written in Rust.From MISP Galaxy
Last reported yesterday, by Help Net Security11 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1110Brute Force
“It covers anything that scans or enumerates systems, brute-forces, parses or stores credentials, decodes malware, manipulates scan configurations, or drives a security tool with write or attack capability.”
- T1486Data Encrypted for Impact
“T1486 Data Encrypted for Impact”
- T1552.004Private Keys
“…features a locker builder and landing page generator, as well as customizable ransom notes and file storage for data leaks. Notably, private keys are not stored on servers.”
- T1684Social Engineering
“41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner.”
- T1007System Service Discovery
“System Service Discovery”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Google opens its cloud to rival OpenAI, promises business data won’t train models“The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna.”
-
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution“curl credits the finding to "Luna with Claude, Anthropic." Stenberg names the reporter as Luna Tong of Anthropic, says the finding came through the company's new OSS Scanner, and presumes its AI models were involved.”
-
Microsoft’s new model helps AI agents judge their next move“Microsoft reported results competitive with GPT5.6 Luna’s, with processing 100 times faster.”
-
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents“GPT-6 Sol and Luna arrive with 50% lower API prices”
-
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests“OpenAI Debuts GPT‑6 Sol and Luna”
-
CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (Severity: MEDIUM)“CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (Severity: MEDIUM)”
-
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI“A standard GA model, such as Luna, handles this entire section.”
-
Choose your fighter: Balancing competing requirements to select models for your AI SOC“We saw a much more pronounced and surprising effect with GPT-5.6 Luna, where increasing the reasoning effort decreased scores at all levels.”
-
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group“Cicada3301 are not the only ones who prefer Rust – Hive, RansomExx, ALPHV, Qilin (Agenda), and Luna have also been observed adopting this programming language.”
-
The Qilin Ransomware: Analysis and Protection Strategies“Rust* A cross-platform programming language used by Qilin along with other nefarious ransomware gangs such as Hive, Blackcat, Luna, etc.”
-
LUNA Ransomware Attack Pattern Analysis“All encrypted files are appended with a .Luna extension, i.e.”
Indicators in its reports
named in the reports above- xss[.]isin 1 report
- process[.]pein 1 report
- 1cbbf108f44c8f4b…fbec2f83ab51in 1 report
- hxxps://xss[.]is/members/376495in 1 report
- 2[.]windowsin 1 report
- 078163d5c16f64ca…e35e6879937bin 1 report
- 7b3022437b637c44…fde179bd984ein 1 report
- 3969e1a88a063155…4abd30553eabin 1 report
- 56e1d092c07322d9…935ca4d2f7e7in 1 report
- com[.]microsoftin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.