A four-stage attack chain linked to the Lunex Malware-as-a-Service platform has been identified and reverse-engineered.