Turla
Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. Turla’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.[1][2][3][4]
Associated Group Descriptions
Name | Description |
---|---|
Waterbug |
Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.[5] |
WhiteBear |
WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.[6] |
VENOMOUS BEAR | |
Snake | |
Krypton |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1134 | .002 | Access Token Manipulation: Create Process with Token |
Turla RPC backdoors can impersonate or steal process tokens before executing commands.[7] |
Enterprise | T1087 | .002 | Account Discovery: Domain Account |
Turla has used |
.001 | Account Discovery: Local Account |
Turla has used |
||
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.[10] |
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
A Turla Javascript backdoor added a local_update_check value under the Registry key |
.004 | Boot or Logon Autostart Execution: Winlogon Helper DLL |
Turla established persistence by adding a Shell value under the Registry key |
||
Enterprise | T1110 | Brute Force |
Turla may attempt to connect to systems within a victim's network using |
|
Enterprise | T1059 | .001 | Command and Scripting Interpreter: PowerShell |
Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject.[9][7][10] Turla has also used PowerShell scripts to load and execute malware in memory. |
.003 | Command and Scripting Interpreter: Windows Command Shell |
Turla RPC backdoors have used cmd.exe to execute commands.[7][10] |
||
.005 | Command and Scripting Interpreter: Visual Basic | |||
Enterprise | T1584 | .003 | Compromise Infrastructure: Virtual Private Server |
Turla has used the VPS infrastructure of compromised Iranian threat actors.[11] |
.006 | Compromise Infrastructure: Web Services |
Turla has frequently used compromised WordPress sites for C2 infrastructure.[12] |
||
.004 | Compromise Infrastructure: Server | |||
Enterprise | T1555 | Credentials from Password Stores |
Turla has gathered credentials from the Windows Credential Manager tool.[10] |
|
Enterprise | T1213 | Data from Information Repositories |
Turla has used a custom .NET tool to collect documents from an organization's internal central database.[8] |
|
Enterprise | T1005 | Data from Local System |
Turla RPC backdoors can upload files from victim machines.[7] |
|
Enterprise | T1025 | Data from Removable Media |
Turla RPC backdoors can collect files from USB thumb drives.[7][10] |
|
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.[7] |
|
Enterprise | T1587 | .001 | Develop Capabilities: Malware |
Turla has developed its own unique malware for use in operations.[12] |
Enterprise | T1189 | Drive-by Compromise | ||
Enterprise | T1546 | .013 | Event Triggered Execution: PowerShell Profile |
Turla has used PowerShell profiles to maintain persistence on an infected machine.[7] |
.003 | Event Triggered Execution: Windows Management Instrumentation Event Subscription |
Turla has used WMI event filters and consumers to establish persistence.[7] |
||
Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Turla has used WebDAV to upload stolen USB files to a cloud drive.[10] Turla has also exfiltrated stolen files to OneDrive and 4shared.[8] |
Enterprise | T1083 | File and Directory Discovery |
Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.[1][8] Turla RPC backdoors have also searched for files matching the |
|
Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.[7] |
Enterprise | T1105 | Ingress Tool Transfer |
Turla has used shellcode to download Meterpreter after compromising a victim.[9] |
|
Enterprise | T1570 | Lateral Tool Transfer |
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.[7][10] |
|
Enterprise | T1112 | Modify Registry |
Turla has used the Registry to store encrypted payloads.[7][10] |
|
Enterprise | T1106 | Native API |
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.[7] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Turla has used encryption (including salted 3DES via PowerSploit's |
|
.005 | Indicator Removal from Tools |
Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.[2] |
||
Enterprise | T1588 | .001 | Obtain Capabilities: Malware |
Turla has used malware obtained after compromising other threat actors, such as OilRig.[11][12] |
Enterprise | T1201 | Password Policy Discovery |
Turla has used |
|
Enterprise | T1120 | Peripheral Device Discovery |
Turla has used |
|
Enterprise | T1069 | .002 | Permission Groups Discovery: Domain Groups |
Turla has used |
.001 | Permission Groups Discovery: Local Groups |
Turla has used |
||
Enterprise | T1566 | .002 | Phishing: Spearphishing Link |
Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.[4] |
.001 | Phishing: Spearphishing Attachment |
Turla has used spearphishing emails to deliver BrainTest as a malicious attachment.[13] |
||
Enterprise | T1057 | Process Discovery |
Turla surveys a system upon check-in to discover running processes using the |
|
Enterprise | T1055 | Process Injection |
Turla has also used PowerSploit's |
|
.001 | Dynamic-link Library Injection |
Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.[9][14] |
||
Enterprise | T1090 | Proxy |
Turla RPC backdoors have included local UPnP RPC proxies.[7] |
|
Enterprise | T1012 | Query Registry |
Turla surveys a system upon check-in to discover information in the Windows Registry with the |
|
Enterprise | T1021 | .002 | Remote Services: SMB/Windows Admin Shares |
Turla used |
Enterprise | T1018 | Remote System Discovery |
Turla surveys a system upon check-in to discover remote systems on a local network using the |
|
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.[8] |
Enterprise | T1082 | System Information Discovery |
Turla surveys a system upon check-in to discover operating system configuration details using the |
|
Enterprise | T1016 | System Network Configuration Discovery |
Turla surveys a system upon check-in to discover network configuration details using the |
|
Enterprise | T1049 | System Network Connections Discovery |
Turla surveys a system upon check-in to discover active local network connections using the |
|
Enterprise | T1007 | System Service Discovery |
Turla surveys a system upon check-in to discover running services and associated processes using the |
|
Enterprise | T1124 | System Time Discovery |
Turla surveys a system upon check-in to discover the system time by using the |
|
Enterprise | T1204 | .001 | User Execution: Malicious Link |
Turla has used spearphishing via a link to get users to download and run their malware.[4] |
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
A Turla JavaScript backdoor has used Google Apps Script as its C2 server.[4][9] |
Software
References
- Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
- ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
- Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018.
- ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
- Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.
- Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
- Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
- Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
- ESET Research. (2018, May 22). Turla Mosquito: A shift towards more generic tools. Retrieved July 3, 2018.
- Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
- NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.
- Insikt Group. (2020, March 12). Swallowing the Snake’s Tail: Tracking Turla Infrastructure. Retrieved October 20, 2020.
- ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
- Rapid7. (2013, November 26). meterpreter/source/extensions/priv/server/elevate/. Retrieved July 8, 2018.
- ESET. (2018, August). Turla Outlook Backdoor: Analysis of an unusual Turla backdoor. Retrieved March 11, 2019.
- Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
- Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.