{
  "family": "lurk",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nLurk refers to both a highly sophisticated Trojan Downloader and the infamous Russian cybercriminal syndicate that created it. The Lurk group was primarily known for orchestrating massive financial heists against Russian and Eastern European banks, stealing millions of dollars before their arrest. The Lurk trojan itself is a modular, fileless malware designed specifically for stealthy infiltration, reconnaissance, and the deployment of specialized banking modules or ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Lurk group heavily utilized strategic web compromises (watering hole attacks) and the \"Angler\" Exploit Kit to distribute the malware. By compromising legitimate news sites or forums frequented by their targets, they could silently infect systems via drive-by downloads without requiring user interaction.\n\nLurk is renowned for its advanced, \"fileless\" architecture:\n<ul>\n<li><strong>In-Memory Execution:</strong> Lurk was one of the first major malware families to operate almost entirely in RAM. The initial exploit executes a small loader that downloads the main payload as an encrypted DLL. This DLL is injected directly into a legitimate process (like `explorer.exe` or `iexplore.exe`) and never touches the physical hard drive, rendering traditional, signature-based AV completely blind.</li>\n<li><strong>Modular Architecture:</strong> The core Lurk trojan is a sophisticated backdoor that acts as a staging platform. The C2 server can push highly customized modules to the infected machine based on the target's value, including specialized banking credential stealers, network reconnaissance tools, or keyloggers.</li>\n<li><strong>Network Evasion:</strong> Lurk utilizes custom encryption protocols and frequently rotates its command-and-control (C2) domains (often using DGAs or compromised legitimate domains) to evade network-level detection and perimeter blocking.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lurk infection is a critical, \"Code Red\" security incident. It indicates a highly targeted attack by an Advanced Persistent Threat (APT)-level criminal syndicate. The malware's primary goal is massive financial theft or, in later campaigns, the deployment of destructive ransomware across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Memory Forensics:</strong> Because Lurk is a fileless threat, traditional disk forensics will yield little evidence. Responders must utilize advanced memory analysis tools (like Volatility) to capture RAM dumps, identify the injected malicious threads, and extract the decrypted payload.</li>\n<li><strong>Network Isolation and Triage:</strong> Isolate the infected machine immediately to sever C2 communication and prevent lateral movement. Analyze corporate firewall and proxy logs to identify the compromised \"watering hole\" website that initiated the infection.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated in-memory capabilities and the likelihood of lateral movement, the only secure remediation is a complete bare-metal wipe and re-image of the compromised endpoint from a clean baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Lurk",
    "Banker.Lurk",
    "Win32/Lurk"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1105",
    "T1189",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:41:13Z",
  "type": "Trojan / Downloader",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}