Attacks/Breaches

8/30/2017
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates

Turla cyber espionage gang has been around for a long time and appears to be back in action after a temporary lull.

The Russian-language speaking advanced persistent threat (APT) group Turla, which appeared to have gone dormant for a while, seems to be back at it again.

In separate advisories, two security vendors this week reported on recent malicious activity that they described as being linked in one way or the other to Turla.

One of the advisories was from ESET and warned about a hitherto undocumented backdoor dubbed Gazer, that members of Turla have begun using relatively recently to spy on embassies and consulates worldwide.

The backdoor is being used in a data-stealing campaign and was discovered on an unspecified number of computers belonging mostly to targets located in Southeastern Europe and member nations of the former Soviet Union.

The other advisory was from Kaspersky Lab and provided details of Turla-related APT activity called WhiteBear that the security vendor had warned its customers about back in mid-February 2017. According to Kaspersky Lab, the WhiteBear campaign appeared to be the second phase of White Atlas, another Turla project that the company had privately warned its customers about in 2016.

As with previous Turla campaigns, WhiteBear's command and control infrastructure also is comprised of a collection of compromised websites and hijacked satellite connections. Some portions of the infrastructure that WhiteBear is using was also used previously in other Turla campaigns, such as one involving a data-stealing backdoor dubbed Kopiluwak.

In addition, attempts to deploy WhiteBear modules are always preceded by attempts to deploy WhiteAtlas as well, further suggesting a link between the two, Kaspersky Lab said.

"The connections appear pretty solid," says Kurt Baumgartner, principal security researcher at Kaspersky Lab, pointing to other similarities such as the use of a shared command and control server and a logging facility that shares components associated with previous Turla campaigns.

Despite such similarities, though, the WhiteBear campaign seems to be a separate and smaller project targeting consular operations, embassies and, starting June, defense organizations as well.

"The target profiles appear to be a subset of what we have seen with WhiteAtlas," Baumgartner says. Several other operations involving WhiteAtlas and other Turla operations also have been broader than what Kaspersky Lab has seen with WhiteBear, he adds.

Meanwhile, Jean-Ian Boutin, senior malware researcher at ESET, says the security vendor was able to tie Gazer to Turla because of its similarities with Carbon and Kazuar - two other backdoors that the Turla group has used. "For example, they can all receive encrypted tasks from a C&C server, which can be executed either by the infected machine or by another compromised machine on the network," he says.

Similarly, all the malware samples use an encrypted container to store the malware’s components and configuration information and to also log their actions in a file, Boutin says. Skipper, yet another backdoor associated with Turla, was found alongside Gazer in most of the cases that ESET investigated, Boutin says.

"Turla is very sophisticated – they are constantly changing their tools to evade detection, and all of their second stage backdoor implements advanced techniques to remain persistent and stealthy on a system," he says.

The alerts from Kaspersky Lab and ESET mark the second and the third time this month that a security vendor has reported on Turla. Earlier, Proofpoint said it had discovered a new JavaScript dropper for the KopiLuwak backdoor being used in a data theft campaign targeting G20 participants. Among those targeted by the campaign that Proofpoint reported were policymakers, journalists, and representatives from G20 member nations.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

 

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
Good Times in Security Come When You Least Expect Them
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  10/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.