Attacks/Breaches

8/30/2017
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates

Turla cyber espionage gang has been around for a long time and appears to be back in action after a temporary lull.

The Russian-language speaking advanced persistent threat (APT) group Turla, which appeared to have gone dormant for a while, seems to be back at it again.

In separate advisories, two security vendors this week reported on recent malicious activity that they described as being linked in one way or the other to Turla.

One of the advisories was from ESET and warned about a hitherto undocumented backdoor dubbed Gazer, that members of Turla have begun using relatively recently to spy on embassies and consulates worldwide.

The backdoor is being used in a data-stealing campaign and was discovered on an unspecified number of computers belonging mostly to targets located in Southeastern Europe and member nations of the former Soviet Union.

The other advisory was from Kaspersky Lab and provided details of Turla-related APT activity called WhiteBear that the security vendor had warned its customers about back in mid-February 2017. According to Kaspersky Lab, the WhiteBear campaign appeared to be the second phase of White Atlas, another Turla project that the company had privately warned its customers about in 2016.

As with previous Turla campaigns, WhiteBear's command and control infrastructure also is comprised of a collection of compromised websites and hijacked satellite connections. Some portions of the infrastructure that WhiteBear is using was also used previously in other Turla campaigns, such as one involving a data-stealing backdoor dubbed Kopiluwak.

In addition, attempts to deploy WhiteBear modules are always preceded by attempts to deploy WhiteAtlas as well, further suggesting a link between the two, Kaspersky Lab said.

"The connections appear pretty solid," says Kurt Baumgartner, principal security researcher at Kaspersky Lab, pointing to other similarities such as the use of a shared command and control server and a logging facility that shares components associated with previous Turla campaigns.

Despite such similarities, though, the WhiteBear campaign seems to be a separate and smaller project targeting consular operations, embassies and, starting June, defense organizations as well.

"The target profiles appear to be a subset of what we have seen with WhiteAtlas," Baumgartner says. Several other operations involving WhiteAtlas and other Turla operations also have been broader than what Kaspersky Lab has seen with WhiteBear, he adds.

Meanwhile, Jean-Ian Boutin, senior malware researcher at ESET, says the security vendor was able to tie Gazer to Turla because of its similarities with Carbon and Kazuar - two other backdoors that the Turla group has used. "For example, they can all receive encrypted tasks from a C&C server, which can be executed either by the infected machine or by another compromised machine on the network," he says.

Similarly, all the malware samples use an encrypted container to store the malware’s components and configuration information and to also log their actions in a file, Boutin says. Skipper, yet another backdoor associated with Turla, was found alongside Gazer in most of the cases that ESET investigated, Boutin says.

"Turla is very sophisticated – they are constantly changing their tools to evade detection, and all of their second stage backdoor implements advanced techniques to remain persistent and stealthy on a system," he says.

The alerts from Kaspersky Lab and ESET mark the second and the third time this month that a security vendor has reported on Turla. Earlier, Proofpoint said it had discovered a new JavaScript dropper for the KopiLuwak backdoor being used in a data theft campaign targeting G20 participants. Among those targeted by the campaign that Proofpoint reported were policymakers, journalists, and representatives from G20 member nations.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

 

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Researchers Offer a 'VirusTotal for ICS'
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.