OTX Threat: Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer

The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products. The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the tech CVEs: CVE-2017-7921, CVE-2021-21974, CVE-2021-3493, CVE-2022-21894, CVE-2021-4034