Attacks/Breaches

8/30/2017
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates

Turla cyber espionage gang has been around for a long time and appears to be back in action after a temporary lull.

The Russian-language speaking advanced persistent threat (APT) group Turla, which appeared to have gone dormant for a while, seems to be back at it again.

In separate advisories, two security vendors this week reported on recent malicious activity that they described as being linked in one way or the other to Turla.

One of the advisories was from ESET and warned about a hitherto undocumented backdoor dubbed Gazer, that members of Turla have begun using relatively recently to spy on embassies and consulates worldwide.

The backdoor is being used in a data-stealing campaign and was discovered on an unspecified number of computers belonging mostly to targets located in Southeastern Europe and member nations of the former Soviet Union.

The other advisory was from Kaspersky Lab and provided details of Turla-related APT activity called WhiteBear that the security vendor had warned its customers about back in mid-February 2017. According to Kaspersky Lab, the WhiteBear campaign appeared to be the second phase of White Atlas, another Turla project that the company had privately warned its customers about in 2016.

As with previous Turla campaigns, WhiteBear's command and control infrastructure also is comprised of a collection of compromised websites and hijacked satellite connections. Some portions of the infrastructure that WhiteBear is using was also used previously in other Turla campaigns, such as one involving a data-stealing backdoor dubbed Kopiluwak.

In addition, attempts to deploy WhiteBear modules are always preceded by attempts to deploy WhiteAtlas as well, further suggesting a link between the two, Kaspersky Lab said.

"The connections appear pretty solid," says Kurt Baumgartner, principal security researcher at Kaspersky Lab, pointing to other similarities such as the use of a shared command and control server and a logging facility that shares components associated with previous Turla campaigns.

Despite such similarities, though, the WhiteBear campaign seems to be a separate and smaller project targeting consular operations, embassies and, starting June, defense organizations as well.

"The target profiles appear to be a subset of what we have seen with WhiteAtlas," Baumgartner says. Several other operations involving WhiteAtlas and other Turla operations also have been broader than what Kaspersky Lab has seen with WhiteBear, he adds.

Meanwhile, Jean-Ian Boutin, senior malware researcher at ESET, says the security vendor was able to tie Gazer to Turla because of its similarities with Carbon and Kazuar - two other backdoors that the Turla group has used. "For example, they can all receive encrypted tasks from a C&C server, which can be executed either by the infected machine or by another compromised machine on the network," he says.

Similarly, all the malware samples use an encrypted container to store the malware’s components and configuration information and to also log their actions in a file, Boutin says. Skipper, yet another backdoor associated with Turla, was found alongside Gazer in most of the cases that ESET investigated, Boutin says.

"Turla is very sophisticated – they are constantly changing their tools to evade detection, and all of their second stage backdoor implements advanced techniques to remain persistent and stealthy on a system," he says.

The alerts from Kaspersky Lab and ESET mark the second and the third time this month that a security vendor has reported on Turla. Earlier, Proofpoint said it had discovered a new JavaScript dropper for the KopiLuwak backdoor being used in a data theft campaign targeting G20 participants. Among those targeted by the campaign that Proofpoint reported were policymakers, journalists, and representatives from G20 member nations.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

 

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12692
PUBLISHED: 2018-06-23
TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the wps_setup_pin parameter to /data/wps.setup.json.
CVE-2018-12693
PUBLISHED: 2018-06-23
Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a denial of service (outage) via a long type parameter to /data/syslog.filter.json.
CVE-2018-12694
PUBLISHED: 2018-06-23
TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json.
CVE-2018-12695
PUBLISHED: 2018-06-23
mao10cms 6 allows XSS via the m=bbs&a=index page.
CVE-2018-12696
PUBLISHED: 2018-06-23
mao10cms 6 allows XSS via the article page.