Turla

🔴 High

Last Updated

Also known as: APT-C-29, ATG26, ATK 13, ATK13, BELUGASTURGEON, Belugasturgeon, Blue Python, Boulder Bear, CTG-8875, G0010, Group 88, Group88, Hippo Team, IRON HUNTER, ITG12, Iron Hunter, Iron Pioneer, KRYPTON, Krypton, MAKERSMARK, Makersmark, Minime, Operation “Epic Turla”, Operation “Moonlight Maze”, Operation “Penguin Turla”, Operation “Satellite Turla”, Operation “Skipper Turla”, Operation “Turla Mosquito”, Operation “WITCHCOVEN”, Pacifier APT, Pensive Ursa, Pfinet, Popeye, SIG15, SIG2, SIG23, SUMMIT, Secret Blizzard, Skipper Turla, Snake, Summit, TAG-0530, TAG_0530, TURLA RELIC, Turla, Turla - APT-C-29, Turla Group, Turla Team, Turla, Waterbug, Venomous Bear, Group 88, UAC-0003, UAC-0024, UAC-0144, UNC4210, Uroburos, VENOMOUS BEAR, VENOMOUS Bear, Venomous Bear, WRAITH, Waterbug, White Atlas, White Bear, WhiteBear, Witchcoven, Wraith, Турла

Turla is a cyber espionage threat group that has been attributed to Russia’s Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos. Kaspersky Turla ESET Gazer Aug 2017 CrowdStrike VENOMOUS BEAR ESET Turla Mosquito Jan 2018 Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

🌍 Country Russia
📅 Activity 2014 — 2019
📝 Last Updated
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0010
Government, Administration Education Electric Energy Health Government Military Private sector
2014
2019

Targeted Victims

France Romania Kazakhstan Poland Tajikistan Russia United States Saudi Arabia Germany India Belarus Netherlands Iran Uzbekistan Iraq South Korea United Kingdom

Associated Operations

000 comments written on the performer’s post (shown below) was one that could easily pass as spam. 1996 2008-11 2013 2014 2014-12 2015 2016-11 2017 2017-03 2017-05 2017-06 2017-07 2017-08 2018 2018-01 2018-03 2019 2019 Early 2019 has seen the Turla actor actively renew its arsenal. Its developers are still using a familiar coding style 2019-04 2019-05 2019-09 2019-11 2020-01 2020-06 2021-01 2021-02 2021-09 2022-03 2022-04 2022-05 2022-09 2022-12 2023-07 2023-12 2024 A notorious hacking group is targeting the UK with an updated version of malware designed to embed itself into compromised networks and stealthily conduct espionage. Accenture Cyber Threat Intelligence researchers identified a Turla compromise of a European government organization. During this compromise Turla utilized a combination of remote procedure call (RPC)-based backdoors At the best of our knowledge Both the Neuron and Nautilus malware variants have previously been attributed to the Turla advanced persistent threat group Breach of the Swiss military firm RUAG Breach of the US Department of Defense COMpfun authors spoof visa application with HTTP status-based Trojan COMpfun successor Reductor infects files on the fly to compromise TLS traffic During our investigation ESET Research uncovered a new backdoor on a server belonging to a Ministry of Foreign Affairs in Eastern Europe. ESET researchers found a previously undocumented backdoor and document stealer. Dubbed Crutch by its developers ESET researchers found a watering hole (aka strategic web compromise) operation targeting several high-profile Armenian websites. It relies on a fake Adobe Flash update lure and delivers two previously undocumented pieces of malware we have dubbed NetFlash and PyFlash. ESET researchers have observed a significant change in the campaign of the infamous espionage group Epic Turla Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats Germany. In January 2021 In this case IronNetInjector: Turla’s New Malware Loading Tool John Lambert of Microsoft (@JohnLaTwC) tweeted about a malicious document that dropped a “very interesting .JS backdoor“. Since the end of November 2016 Kaspersky Lab has observed Turla using this new JavaScript payload and specific macro variant. Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call “Epic Turla”. The attackers behind Epic Turla have infected several hundred computers in more than 45 countries Microsoft: Hackers turn Exchange servers into malware control centers Moonlight Maze Mosquito Much of our 2018 research focused on Turla’s KopiLuwak javascript backdoor New backdoor Gazer New backdoor Kazuar New versions of Carbon Obviously On 28 January 2017 Operation “Epic Turla” Operation “Moonlight Maze” Operation “Penguin Turla” Operation “Satellite Turla” Operation “Skipper Turla” Operation “Turla Mosquito” Operation “WITCHCOVEN” Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla) Over the last 10 months RUAG hack Russian malware link hid in a comment on Britney Spears’ Instagram Satellite Turla Snowblind: The Invisible Hand of Secret Blizzard Some of the tactics used in APT attacks die hard. A good example is provided by Turla’s watering hole campaigns. Turla Starting in March 2018 TURLA’s new phishing-based reconnaissance campaign in Eastern Europe That is why our experts The 'Penquin' Turla The Slovak IT security company ESET Security released a report yesterday detailing a cleverly hidden example of such a post. And its hideout? A Britney Spears photo. Among the nearly 7 The Turla APT campaigns have a broader reach than initially anticipated after the recent discovery of two modules built to infect servers running Linux. Until now The Turla espionage group has been targeting various institutions for many years. Recently The investigation was called “Operation Buckshot Yankee” and led to the establishment of U.S. Cyber Command. TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines TinyTurla Next Generation - Turla APT spies on Polish NGOs Turla Turla accessed and used the Command and Control (C2) infrastructure of Iranian APTs to deploy their own tools to victims of interest. Turla directly accessed ‘Poison Frog’ C2 panels from their own infrastructure and used this access to task victims to download additional tools. Turla: A Galaxy of Opportunity Waterbug may have hijacked a separate espionage group’s infrastructure during one attack against a Middle Eastern target. When an unsuspecting user visits any of the over 100 compromised websites Witchcoven a group TAG attributes to Russia FSB a group publicly attributed to Russia’s Federal Security Service (FSB) a second stage backdoor in the Turla group arsenal. a small piece of inserted code—embedded in the site’s HTML and invisible to casual visitors—quietly redirects the user’s browser to a second compromised website without the user’s knowledge. This second website hosts the WITCHCOVEN script active since at least 1996. It is of particular interest because several independent experts from countries have voiced the proposition that it is associated with a much more modern — and still active — group aided by researchers from King’s College London also known as Snake and borrowed injector code. We tied some of this activity together with infrastructure and data points from WhiteBear and Mosquito infrastructure and activity in 2017 and 2018. and other commercial organisations. as an example at least but researchers at Kaspersky Lab have discovered otherwise. but there is a much simpler way to hijack satellite-based Internet traffic. but they’re creating new tools. Here we’ll tell you about several of them continues to run campaigns against the Baltics customized PoshSec-Mod open-source powershell use early 2020. education embassies energy every Turla sample in captivity was designed for either 32- or 64-bit Windows systems government officials and diplomats for years – see have carefully studied Moonlight Maze — one of the first widely known cyberespionage campaigns https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/ https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/ https://blog.lumen.com/snowblind-the-invisible-hand-of-secret-blizzard/ https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/ https://blog.talosintelligence.com/2021/09/tinyturla.html https://blog.talosintelligence.com/tinyturla-next-generation/ https://securelist.com/compfun-http-status-based-trojan/96874/ https://securelist.com/compfun-successor-reductor/93633/ https://securelist.com/introducing-whitebear/81638/ https://securelist.com/kopiluwak-a-new-javascript-payload-from-turla/77429/ https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/ https://securelist.com/shedding-skin-turlas-fresh-faces/88069/ https://securelist.com/the-epic-turla-operation/65545/ https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/ https://threatpost.com/linux-modules-connected-to-turla-apt-discovered/109765/ https://unit42.paloaltonetworks.com/ironnetinjector/ https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor/ https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/ https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity https://www.bleepingcomputer.com/news/security/microsoft-hackers-turn-exchange-servers-into-malware-control-centers/ https://www.engadget.com/2017/06/07/russian-malware-hidden-britney-spears-instagram/ https://www.kaspersky.com/blog/moonlight-maze-the-lessons/6713/ https://www.mandiant.com/resources/blog/turla-galaxy-opportunity https://www.melani.admin.ch/melani/en/home/dokumentation/reports/technical-reports/technical-report_apt_case_ruag.html https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/ https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims https://www.nytimes.com/2010/08/26/technology/26cyber.html https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments https://www.telsy.com/turla-venomous-bear-updates-its-arsenal-newpass-appears-on-the-apt-threat-scene/ https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/ https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/ https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/ https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/ https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/ https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf https://www.zdnet.com/article/this-hacking-gang-just-updated-the-malware-it-uses-against-uk-targets/ https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf in-memory loading and execution of malware executables and libraries. This allows them to bypass detection that can trigger when a malicious executable is dropped on disk. including government including government institutions is an infamous espionage group recognized for its complex malware. To confound detection it was used from 2015 to its operators recently started using PowerShell scripts that provide direct military namely “Topinambour” (aka Sunchoke – the Jerusalem artichoke) and its related modules. We didn’t choose to name it after a vegetable new variants of the Carbon framework and meterpreter delivery techniques. Also interesting was Mosquito’s changing delivery techniques recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment. research and pharmaceutical companies. such as HyperStack and remote administration trojans (RATs) such as Kazuar and Carbon such as backbone routers or fiber optics. There are signs that such attacks are becoming more common such incredibly apparent and large-scale attacks have little chance of surviving for long periods of time targeting defense and cybersecurity organizations in the region. technology that we internally named “NewPass“ as one of the parameters used to send exfiltrated data to the command and control. the .NET malware developers named it Topinambour themselves. the authors of the Turla APT attack. the dropper is being delivered with a benign and possibly stolen decoy document inviting recipients to a G20 task force meeting on the “Digital Economy”. The Digital Economy event is actually scheduled for October of this year in Hamburg they have been using them since at least 2014 with very few variations in their modus operandi. this recent paper – is still using watering hole techniques to redirect potentially interesting victims to their C&C infrastructure. In fact this time the hacking group used a previously unseen implant unless the attackers have direct control over some high-traffic network points we found several new versions of Carbon we identified a total of 14 websites hosting the WITCHCOVEN profiling script. we observed a significant change in the campaign: it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor. we were able to attribute it to the infamous Turla APT group. According to our research we were able to identify three different targets where ComRAT v4 has been used: which ACTI researchers analyzed between June and October 2020. which has been targeting governments which is one of the key requirements for running an APT operation. It is therefore not very feasible to perform the attack through MitM traffic hijacking which regularly carries out cyber-espionage against a range of targets which uses profiling techniques to collect technical information on the user’s computer. As of early November 2015 • One national parliament in the Caucasus region • Two Ministries of Foreign Affairs in Eastern Europe

Introduction

Turla is a cyber espionage threat group that has been attributed to Russia’s Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos. Kaspersky Turla ESET Gazer Aug 2017 CrowdStrike VENOMOUS BEAR ESET Turla Mosquito Jan 2018 Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

Activities and Tactics

Targeted Sectors: Government, Administration, Education, Electric, Energy, Health, Government, Military, Private sector

Country of Origin: 🇷🇺 Russia

Risk Level: High

First Seen: 2014

Last Activity: 2019

Incident Type: Espionage

Suspected Victims: France, Romania, Kazakhstan, Poland, Tajikistan, Russia, United States, Saudi Arabia, Germany, India…

Notable Campaigns

  • 000 comments written on the performer’s post (shown below) was one that could easily pass as spam.
  • 1996
  • 2008-11
  • 2013
  • 2014
  • 2014-12
  • 2015
  • 2016-11
  • 2017
  • 2017-03
  • 2017-05
  • 2017-06
  • 2017-07
  • 2017-08
  • 2018
  • 2018-01
  • 2018-03
  • 2019
  • 2019 Early
  • 2019 has seen the Turla actor actively renew its arsenal. Its developers are still using a familiar coding style
  • 2019-04
  • 2019-05
  • 2019-09
  • 2019-11
  • 2020-01
  • 2020-06
  • 2021-01
  • 2021-02
  • 2021-09
  • 2022-03
  • 2022-04
  • 2022-05
  • 2022-09
  • 2022-12
  • 2023-07
  • 2023-12
  • 2024
  • A notorious hacking group is targeting the UK with an updated version of malware designed to embed itself into compromised networks and stealthily conduct espionage.
  • Accenture Cyber Threat Intelligence researchers identified a Turla compromise of a European government organization. During this compromise Turla utilized a combination of remote procedure call (RPC)-based backdoors
  • At the best of our knowledge
  • Both the Neuron and Nautilus malware variants have previously been attributed to the Turla advanced persistent threat group
  • Breach of the Swiss military firm RUAG
  • Breach of the US Department of Defense
  • COMpfun authors spoof visa application with HTTP status-based Trojan
  • COMpfun successor Reductor infects files on the fly to compromise TLS traffic
  • During our investigation
  • ESET Research uncovered a new backdoor on a server belonging to a Ministry of Foreign Affairs in Eastern Europe.
  • ESET researchers found a previously undocumented backdoor and document stealer. Dubbed Crutch by its developers
  • ESET researchers found a watering hole (aka strategic web compromise) operation targeting several high-profile Armenian websites. It relies on a fake Adobe Flash update lure and delivers two previously undocumented pieces of malware we have dubbed NetFlash and PyFlash.
  • ESET researchers have observed a significant change in the campaign of the infamous espionage group
  • Epic Turla
  • Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments
  • Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats
  • Germany.
  • In January 2021
  • In this case
  • IronNetInjector: Turla’s New Malware Loading Tool
  • John Lambert of Microsoft (@JohnLaTwC) tweeted about a malicious document that dropped a “very interesting .JS backdoor“. Since the end of November 2016
  • Kaspersky Lab has observed Turla using this new JavaScript payload and specific macro variant.
  • Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call “Epic Turla”. The attackers behind Epic Turla have infected several hundred computers in more than 45 countries
  • Microsoft: Hackers turn Exchange servers into malware control centers
  • Moonlight Maze
  • Mosquito
  • Much of our 2018 research focused on Turla’s KopiLuwak javascript backdoor
  • New backdoor Gazer
  • New backdoor Kazuar
  • New versions of Carbon
  • Obviously
  • On 28 January 2017
  • Operation “Epic Turla”
  • Operation “Moonlight Maze”
  • Operation “Penguin Turla”
  • Operation “Satellite Turla”
  • Operation “Skipper Turla”
  • Operation “Turla Mosquito”
  • Operation “WITCHCOVEN”
  • Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)
  • Over the last 10 months
  • RUAG hack
  • Russian malware link hid in a comment on Britney Spears’ Instagram
  • Satellite Turla
  • Snowblind: The Invisible Hand of Secret Blizzard
  • Some of the tactics used in APT attacks die hard. A good example is provided by Turla’s watering hole campaigns. Turla
  • Starting in March 2018
  • TURLA’s new phishing-based reconnaissance campaign in Eastern Europe
  • That is why our experts
  • The ‘Penquin’ Turla
  • The Slovak IT security company ESET Security released a report yesterday detailing a cleverly hidden example of such a post. And its hideout? A Britney Spears photo. Among the nearly 7
  • The Turla APT campaigns have a broader reach than initially anticipated after the recent discovery of two modules built to infect servers running Linux. Until now
  • The Turla espionage group has been targeting various institutions for many years. Recently
  • The investigation was called “Operation Buckshot Yankee” and led to the establishment of U.S. Cyber Command.
  • TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines
  • TinyTurla Next Generation - Turla APT spies on Polish NGOs
  • Turla
  • Turla accessed and used the Command and Control (C2) infrastructure of Iranian APTs to deploy their own tools to victims of interest. Turla directly accessed ‘Poison Frog’ C2 panels from their own infrastructure and used this access to task victims to download additional tools.
  • Turla: A Galaxy of Opportunity
  • Waterbug may have hijacked a separate espionage group’s infrastructure during one attack against a Middle Eastern target.
  • When an unsuspecting user visits any of the over 100 compromised websites
  • Witchcoven
  • a group TAG attributes to Russia FSB
  • a group publicly attributed to Russia’s Federal Security Service (FSB)
  • a second stage backdoor in the Turla group arsenal.
  • a small piece of inserted code—embedded in the site’s HTML and invisible to casual visitors—quietly redirects the user’s browser to a second compromised website without the user’s knowledge. This second website hosts the WITCHCOVEN script
  • active since at least 1996. It is of particular interest because several independent experts from countries have voiced the proposition that it is associated with a much more modern — and still active — group
  • aided by researchers from King’s College London
  • also known as Snake
  • and borrowed injector code. We tied some of this activity together with infrastructure and data points from WhiteBear and Mosquito infrastructure and activity in 2017 and 2018.
  • and other commercial organisations.
  • as an example
  • at least
  • but researchers at Kaspersky Lab have discovered otherwise.
  • but there is a much simpler way to hijack satellite-based Internet traffic.
  • but they’re creating new tools. Here we’ll tell you about several of them
  • continues to run campaigns against the Baltics
  • customized PoshSec-Mod open-source powershell use
  • early 2020.
  • education
  • embassies
  • energy
  • every Turla sample in captivity was designed for either 32- or 64-bit Windows systems
  • government officials and diplomats for years – see
  • have carefully studied Moonlight Maze — one of the first widely known cyberespionage campaigns
  • https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/
  • https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/
  • https://blog.lumen.com/snowblind-the-invisible-hand-of-secret-blizzard/
  • https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/
  • https://blog.talosintelligence.com/2021/09/tinyturla.html
  • https://blog.talosintelligence.com/tinyturla-next-generation/
  • https://securelist.com/compfun-http-status-based-trojan/96874/
  • https://securelist.com/compfun-successor-reductor/93633/
  • https://securelist.com/introducing-whitebear/81638/
  • https://securelist.com/kopiluwak-a-new-javascript-payload-from-turla/77429/
  • https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/
  • https://securelist.com/shedding-skin-turlas-fresh-faces/88069/
  • https://securelist.com/the-epic-turla-operation/65545/
  • https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/
  • https://threatpost.com/linux-modules-connected-to-turla-apt-discovered/109765/
  • https://unit42.paloaltonetworks.com/ironnetinjector/
  • https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backdoor/
  • https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/
  • https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
  • https://www.bleepingcomputer.com/news/security/microsoft-hackers-turn-exchange-servers-into-malware-control-centers/
  • https://www.engadget.com/2017/06/07/russian-malware-hidden-britney-spears-instagram/
  • https://www.kaspersky.com/blog/moonlight-maze-the-lessons/6713/
  • https://www.mandiant.com/resources/blog/turla-galaxy-opportunity
  • https://www.melani.admin.ch/melani/en/home/dokumentation/reports/technical-reports/technical-report_apt_case_ruag.html
  • https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
  • https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims
  • https://www.nytimes.com/2010/08/26/technology/26cyber.html
  • https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack
  • https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments
  • https://www.telsy.com/turla-venomous-bear-updates-its-arsenal-newpass-appears-on-the-apt-threat-scene/
  • https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
  • https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/
  • https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/
  • https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
  • https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/
  • https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
  • https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
  • https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
  • https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf
  • https://www.zdnet.com/article/this-hacking-gang-just-updated-the-malware-it-uses-against-uk-targets/
  • https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf
  • in-memory loading and execution of malware executables and libraries. This allows them to bypass detection that can trigger when a malicious executable is dropped on disk.
  • including government
  • including government institutions
  • is an infamous espionage group recognized for its complex malware. To confound detection
  • it was used from 2015 to
  • its operators recently started using PowerShell scripts that provide direct
  • military
  • namely “Topinambour” (aka Sunchoke – the Jerusalem artichoke) and its related modules. We didn’t choose to name it after a vegetable
  • new variants of the Carbon framework and meterpreter delivery techniques. Also interesting was Mosquito’s changing delivery techniques
  • recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.
  • research and pharmaceutical companies.
  • such as HyperStack and remote administration trojans (RATs)
  • such as Kazuar and Carbon
  • such as backbone routers or fiber optics. There are signs that such attacks are becoming more common
  • such incredibly apparent and large-scale attacks have little chance of surviving for long periods of time
  • targeting defense and cybersecurity organizations in the region.
  • technology
  • that we internally named “NewPass“ as one of the parameters used to send exfiltrated data to the command and control.
  • the .NET malware developers named it Topinambour themselves.
  • the authors of the Turla APT attack.
  • the dropper is being delivered with a benign and possibly stolen decoy document inviting recipients to a G20 task force meeting on the “Digital Economy”. The Digital Economy event is actually scheduled for October of this year in Hamburg
  • they have been using them since at least 2014 with very few variations in their modus operandi.
  • this recent paper – is still using watering hole techniques to redirect potentially interesting victims to their C&C infrastructure. In fact
  • this time the hacking group used a previously unseen implant
  • unless the attackers have direct control over some high-traffic network points
  • we found several new versions of Carbon
  • we identified a total of 14 websites hosting the WITCHCOVEN profiling script.
  • we observed a significant change in the campaign: it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor.
  • we were able to attribute it to the infamous Turla APT group. According to our research
  • we were able to identify three different targets where ComRAT v4 has been used:
  • which ACTI researchers analyzed between June and October 2020.
  • which has been targeting governments
  • which is one of the key requirements for running an APT operation. It is therefore not very feasible to perform the attack through MitM traffic hijacking
  • which regularly carries out cyber-espionage against a range of targets
  • which uses profiling techniques to collect technical information on the user’s computer. As of early November 2015
  • • One national parliament in the Caucasus region
  • • Two Ministries of Foreign Affairs in Eastern Europe

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 11 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • PowerDuke
  • POWERSTATS
  • Power Loader
  • POWERSOURCE
  • China Chopper
  • Archelaus Beta
  • PowerRAT
  • CrossRat
  • CyberAzov
  • Unidentified ASP 001 (Webshell)
  • Penquin Turla
  • KopiLuwak
  • MiniJS
  • HTML5 Encoding
  • Maintools.js
  • Uroburos
  • DeliveryCheck
  • LunarMail
  • NetFlash
  • Neuron
  • QUIETCANARY
  • Pelmeni
  • TwoDash
  • TwoFace
  • Agent.BTZ
  • ApolloShadow
  • Cobra Carbon System
  • ComLook
  • Crutch
  • Gazer
  • KSL0T
  • LightNeuron
  • MiniPocket
  • Mosquito
  • Nautilus
  • NewPass
  • Outlook Backdoor
  • PowerShellRunner
  • Satellite Turla
  • Skipper
  • TinyTurla
  • TinyTurlaNG
  • TurlaRPC
  • Turla SilentMoon
  • Wipbot
  • Kazuar
  • systeminfo
  • net
  • tasklist
  • gpresult
  • wce
  • pwdump
  • Turla
  • Tavdig
  • Agent.dne
  • AdobeARM
  • ATI-Agent
  • MiniDionis
  • WhiteBear
  • systeminfo:
  • net:
  • tasklist:
  • gpresult:
  • wce:
  • pwdump:
  • Uroburos:
  • Turla:
  • Agent.BTZ:
  • Tavdig:
  • Wipbot:
  • Agent.dne:
  • AdobeARM:
  • ATI-Agent:
  • MiniDionis:
  • WhiteBear:
  • Gazer:
  • Neuron:
  • Nautilus:
  • ASPXSpy:
  • ApolloShadow:
  • COMpfun:
  • CloudDuke:
  • Cobra Carbon System:
  • ComRAT:
  • Crutch:
  • DoublePulsar:
  • EmpireProject:
  • Epic:
  • EternalBlue:
  • EternalRomance:
  • HTML5 Encoding:
  • HyperStack:
  • IcedCoffee:
  • IronNetInjector:
  • KSL0T:
  • Kazuar:
  • KopiLuwak:
  • LightNeuron:
  • Living off the Land:
  • Maintools.js:
  • Metasploit:
  • Meterpreter:
  • MiamiBeach:
  • Mimikatz:
  • Mosquito:
  • NETVulture:
  • Neptun:
  • NetFlash:
  • NewPass:
  • Outlook Backdoor:
  • Penquin Turla:
  • PowerShellRunner-based RPC backdoor:
  • PowerStallion:
  • PsExec:
  • PyFlash:
  • RocketMan:
  • SMBTouch:
  • SScan:
  • Satellite Turla:
  • Skipper:
  • TinyTurla:
  • TinyTurla-NG:
  • Topinambour:
  • Tunnus:
  • TurlaChopper:
  • WITCHCOVEN:
  • WhiteAtlas:
  • Windows Credentials Editor:
  • certutil:
  • nbtscan:
  • nbtstat:

MITRE ATT&CK Software

Russian APT Tool Matrix observations

Category Observed tools
Credential Theft Mimikatz
Defense Evasion PowerShellRunner, VirtualBox Driver
Discovery NBTScan, SScan
Exfiltration 4Shared, Dropbox, GMX, Gmail, OneDrive, VFEmail
LOLBAS PsExec
Networking Chisel
OffSec Evil-WinRM, Metapsloit, Metasploit, PowerShell Empire, PowerSploit
RMM Tools IntelliAdmin

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [10] Accenture HyperStack October 2020 Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. [12] Talos TinyTurla September 2021 Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. [13] ESET Turla Mosquito Jan 2018 ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. [14] ESET Gazer Aug 2017 ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017. [15] ESET Turla PowerShell May 2019 Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. [16] Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023. [17] Securelist WhiteBear Aug 2017 Kaspersky Lab’s Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017. [18] Kaspersky Turla Kaspersky Lab’s Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. [19] Leonardo Turla Penquin May 2020 Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021. [20] CrowdStrike VENOMOUS BEAR Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018. [21] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [22] Secureworks IRON HUNTER Profile Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022. [23] Symantec Waterbug Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

Recent News

Latest articles from security news feeds mentioning this actor.