Turla, Waterbug, Venomous Bear

[1996] operation �moonlight Maze� (that Is Why Our Experts, Aided By Researchers From King�s College London, Have Carefully Studied Moonlight Maze � One Of The First Widely Known Cyberespionage Campaigns, Active Since At Least 1996. It Is Of Particular Interest Because Several Independent Experts From Countries Have Voiced The Proposition That It Is Associated With A Much More Modern � And Still Active � Group, The Authors Of The Turla Apt Attack. (https://www.kaspersky.com/blog/moonlight-maze-the-lessons/6713/)

[2008-11] breach Of The Us Department Of Defense (https://www.nytimes.com/2010/08/26/technology/26cyber.html (the Investigation Was Called �operation Buckshot Yankee� And Led To The Establishment Of U.s. Cyber Command.)

[2013] operation �epic Turla� (over The Last 10 Months, Kaspersky Lab Researchers Have Analyzed A Massive Cyber-espionage Operation Which We Call �epic Turla�. The Attackers Behind Epic Turla Have Infected Several Hundred Computers In More Than 45 Countries, Including Government Institutions, Embassies, Military, Education, Research And Pharmaceutical Companies. (https://securelist.com/the-epic-turla-operation/65545/)

[2014] breach Of The Swiss Military Firm Ruag (https://www.melani.admin.ch/melani/en/home/dokumentation/reports/technical-reports/technical-report_apt_case_ruag.html)

[2014-12] operation �penguin Turla� (the Turla Apt Campaigns Have A Broader Reach Than Initially Anticipated After The Recent Discovery Of Two Modules Built To Infect Servers Running Linux. Until Now, Every Turla Sample In Captivity Was Designed For Either 32- Or 64-bit Windows Systems, But Researchers At Kaspersky Lab Have Discovered Otherwise. (https://threatpost.com/linux-modules-connected-to-turla-apt-discovered/109765/)

[2015] operation �satellite Turla� (obviously, Such Incredibly Apparent And Large-scale Attacks Have Little Chance Of Surviving For Long Periods Of Time, Which Is One Of The Key Requirements For Running An Apt Operation. It Is Therefore Not Very Feasible To Perform The Attack Through Mitm Traffic Hijacking, Unless The Attackers Have Direct Control Over Some High-traffic Network Points, Such As Backbone Routers Or Fiber Optics. There Are Signs That Such Attacks Are Becoming More Common, But There Is A Much Simpler Way To Hijack Satellite-based Internet Traffic. (https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/)

[2015] operation �witchcoven� (when An Unsuspecting User Visits Any Of The Over 100 Compromised Websites, A Small Piece Of Inserted Code�embedded In The Site�s Html And Invisible To Casual Visitors�quietly Redirects The User�s Browser To A Second Compromised Website Without The User�s Knowledge. This Second Website Hosts The Witchcoven Script, Which Uses Profiling Techniques To Collect Technical Information On The User�s Computer. As Of Early November 2015, We Identified A Total Of 14 Websites Hosting The Witchcoven Profiling Script. (https://www2.fireeye.com/rs/848-did-242/images/rpt-witchcoven.pdf)

[2015] eset Researchers Found A Previously Undocumented Backdoor And Document Stealer. Dubbed Crutch By Its Developers, We Were Able To Attribute It To The Infamous Turla Apt Group. According To Our Research, It Was Used From 2015 To, At Least, Early 2020. (https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/)

[2016-11] operation �skipper Turla� (on 28 January 2017, John Lambert Of Microsoft (@johnlatwc) Tweeted About A Malicious Document That Dropped A �very Interesting .js Backdoor�. Since The End Of November 2016, Kaspersky Lab Has Observed Turla Using This New Javascript Payload And Specific Macro Variant. (https://securelist.com/kopiluwak-a-new-javascript-payload-from-turla/77429/ (https://securelist.com/introducing-whitebear/81638/)

[2017] operation �turla Mosquito� (eset Researchers Have Observed A Significant Change In The Campaign Of The Infamous Espionage Group (https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/)

[2017-03] new Versions Of Carbon (the Turla Espionage Group Has Been Targeting Various Institutions For Many Years. Recently, We Found Several New Versions Of Carbon, A Second Stage Backdoor In The Turla Group Arsenal. (https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/)

[2017-05] new Backdoor Kazuar (https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/)

[2017-06] some Of The Tactics Used In Apt Attacks Die Hard. A Good Example Is Provided By Turla�s Watering Hole Campaigns. Turla, Which Has Been Targeting Governments, Government Officials And Diplomats For Years � See, As An Example, This Recent Paper � Is Still Using Watering Hole Techniques To Redirect Potentially Interesting Victims To Their C&c Infrastructure. In Fact, They Have Been Using Them Since At Least 2014 With Very Few Variations In Their Modus Operandi. (https://www.welivesecurity.com/2017/06/06/turlas-watering-hole-campaign-updated-firefox-extension-abusing-instagram/)

[2017-07] russian Malware Link Hid In A Comment On Britney Spears� Instagram (the Slovak It Security Company Eset Security Released A Report Yesterday Detailing A Cleverly Hidden Example Of Such A Post. And Its Hideout? A Britney Spears Photo. Among The Nearly 7,000 Comments Written On The Performer�s Post (shown Below) Was One That Could Easily Pass As Spam. (https://www.engadget.com/2017/06/07/russian-malware-hidden-britney-spears-instagram/)

[2017-08] new Backdoor Gazer (https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf)

[2017-08] in This Case, The Dropper Is Being Delivered With A Benign And Possibly Stolen Decoy Document Inviting Recipients To A G20 Task Force Meeting On The �digital Economy�. The Digital Economy Event Is Actually Scheduled For October Of This Year In Hamburg, Germany. (https://www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack)

[2018-01] a Notorious Hacking Group Is Targeting The Uk With An Updated Version Of Malware Designed To Embed Itself Into Compromised Networks And Stealthily Conduct Espionage. (both The Neuron And Nautilus Malware Variants Have Previously Been Attributed To The Turla Advanced Persistent Threat Group, Which Regularly Carries Out Cyber-espionage Against A Range Of Targets, Including Government, Military, Technology, Energy, And Other Commercial Organisations. (https://www.zdnet.com/article/this-hacking-gang-just-updated-the-malware-it-uses-against-uk-targets/)

[2018-01] espionage Group Rolls Out Brand-new Toolset In Attacks Against Governments (waterbug May Have Hijacked A Separate Espionage Group�s Infrastructure During One Attack Against A Middle Eastern Target. (https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments)

[2018-03] starting In March 2018, We Observed A Significant Change In The Campaign: It Now Leverages The Open Source Exploitation Framework Metasploit Before Dropping The Custom Mosquito Backdoor. (https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/)

[2018] much Of Our 2018 Research Focused On Turla�s Kopiluwak Javascript Backdoor, New Variants Of The Carbon Framework And Meterpreter Delivery Techniques. Also Interesting Was Mosquito�s Changing Delivery Techniques, Customized Poshsec-mod Open-source Powershell Use, And Borrowed Injector Code. We Tied Some Of This Activity Together With Infrastructure And Data Points From Whitebear And Mosquito Infrastructure And Activity In 2017 And 2018. (https://securelist.com/shedding-skin-turlas-fresh-faces/88069/)

[2019 Early] 2019 Has Seen The Turla Actor Actively Renew Its Arsenal. Its Developers Are Still Using A Familiar Coding Style, But They�re Creating New Tools. Here We�ll Tell You About Several Of Them, Namely �topinambour� (aka Sunchoke � The Jerusalem Artichoke) And Its Related Modules. We Didn�t Choose To Name It After A Vegetable; The .net Malware Developers Named It Topinambour Themselves. (https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/)

[2019-04] compfun Successor Reductor Infects Files On The Fly To Compromise Tls Traffic (https://securelist.com/compfun-successor-reductor/93633/)

[2019-05] turla, Also Known As Snake, Is An Infamous Espionage Group Recognized For Its Complex Malware. To Confound Detection, Its Operators Recently Started Using Powershell Scripts That Provide Direct, In-memory Loading And Execution Of Malware Executables And Libraries. This Allows Them To Bypass Detection That Can Trigger When A Malicious Executable Is Dropped On Disk. (https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/)

[2019] turla Accessed And Used The Command And Control (c2) Infrastructure Of Iranian Apts To Deploy Their Own Tools To Victims Of Interest. Turla Directly Accessed �poison Frog� C2 Panels From Their Own Infrastructure And Used This Access To Task Victims To Download Additional Tools. (https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims)

[2019-09] eset Researchers Found A Watering Hole (aka Strategic Web Compromise) Operation Targeting Several High-profile Armenian Websites. It Relies On A Fake Adobe Flash Update Lure And Delivers Two Previously Undocumented Pieces Of Malware We Have Dubbed Netflash And Pyflash. (https://www.welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-armenian-watering-holes/)

[2019-11] compfun Authors Spoof Visa Application With Http Status-based Trojan (https://securelist.com/compfun-http-status-based-trojan/96874/)

[2020-01] during Our Investigation, We Were Able To Identify Three Different Targets Where Comrat V4 Has Been Used: (� Two Ministries Of Foreign Affairs In Eastern Europe (� One National Parliament In The Caucasus Region (https://www.welivesecurity.com/wp-content/uploads/2020/05/eset_turla_comrat.pdf)

[2020-06] at The Best Of Our Knowledge, This Time The Hacking Group Used A Previously Unseen Implant, That We Internally Named �newpass� As One Of The Parameters Used To Send Exfiltrated Data To The Command And Control. (https://www.telsy.com/turla-venomous-bear-updates-its-arsenal-newpass-appears-on-the-apt-threat-scene/)

[2020-06] accenture Cyber Threat Intelligence Researchers Identified A Turla Compromise Of A European Government Organization. During This Compromise Turla Utilized A Combination Of Remote Procedure Call (rpc)-based Backdoors, Such As Hyperstack And Remote Administration Trojans (rats), Such As Kazuar And Carbon, Which Acti Researchers Analyzed Between June And October 2020. (https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity)

[2021-01] in January 2021, Eset Research Uncovered A New Backdoor On A Server Belonging To A Ministry Of Foreign Affairs In Eastern Europe. (https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf)

[2021-02] ironnetinjector: Turla�s New Malware Loading Tool (https://unit42.paloaltonetworks.com/ironnetinjector/)

[2021-09] tinyturla - Turla Deploys New Malware To Keep A Secret Backdoor On Victim Machines (https://blog.talosintelligence.com/2021/09/tinyturla.html)

[2022-03] turla, A Group Publicly Attributed To Russia�s Federal Security Service (fsb), Recently Hosted Android Apps On A Domain Spoofing The Ukrainian Azov Regiment. (https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag/)

[2022-04] turla, A Group Tag Attributes To Russia Fsb, Continues To Run Campaigns Against The Baltics, Targeting Defense And Cybersecurity Organizations In The Region. (https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/)

[2022-05] turla�s New Phishing-based Reconnaissance Campaign In Eastern Europe (https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/)

[2022-09] turla: A Galaxy Of Opportunity (https://www.mandiant.com/resources/blog/turla-galaxy-opportunity