Lunex Malware Targets Ukrainian Users with BYOVD Exploit

• •Lunex malware targets Ukrainian users via a four-stage attack chain.
• •BYOVD technique used to disable security monitoring before deploying the stealer.
• •CVE-2023-20598 exploited in AMD drivers to escalate privileges.

The Lunex Malware-as-a-Service platform has been identified as targeting Ukrainian-speaking users through a sophisticated four-stage attack chain. The attack begins with a fake CAPTCHA page and employs a Bring Your Own Vulnerable Driver (BYOVD) technique to disable security monitoring before deploying the LunexStealer, which extracts credentials from seven Chromium-based browsers and exfiltrates cryptocurrency wallets. The malware exploits a vulnerability in the AMD Radeon driver (CVE-2023-20598) to escalate privileges and evade detection. The Lunex platform has been linked to Russian-speaking threat actors, with 28 command-and-control panels identified across 13 countries. This malware campaign is notable for its method of using legitimate drivers to bypass security measures, making it a significant threat to affected users. The attack chain was first documented in detail by Ontinue Cyber Defence Centre on September 27, 2026.