September 25, 2018 By David Bisson 2 min read

Researchers determined that the victims of a backdoor developed by the advanced persistent threat (APT) group Turla are more numerous than originally expected.

The threat group recently employed the backdoor to access the foreign offices of two European countries and a major defense contractor, according to Slovakian IT security company ESET. Those victims received less publicity than Germany’s Federal Foreign Office, which the group breached after compromising the network of the country’s Federal College of Public Administration.

The most recent versions of Turla’s invention went after targets’ inboxes by subverting Microsoft Office’s Messaging Application Programming Interface (MAPI). They were fully controllable by email and didn’t rely on a conventional command-and-control (C&C) server. Instead, the backdoors used specially crafted PDF files in email attachments to fulfill a series of commands such as data exfiltration. The most recent variant from April 2018 was also capable of executing PowerShell commands by leveraging Empire PSInject.

Turla’s Threat Innovation Continues

In 2017, ESET observed Turla leveraging another backdoor called Gazer to target embassies and government organizations around the world. A year later, researchers found evidence that the threat group was bundling the backdoors with a legitimate Adobe Flash Player installer and using URLs and IP addresses that appeared identical to Adobe’s actual infrastructure.

Given ESET’s most recent findings, Turla is showing no signs of slowing down its efforts to spy on promising targets and secretly infect networks with malware for as long as possible.

How to Block an Email-Borne Backdoor

To defend against this and other backdoor threats, security teams should monitor for the indicators of compromise (IoCs) listed in the IBM X-Force Exchange threat advisory. Security experts also recommend following the National Institute of Standards and Technology’s (NIST) cybersecurity framework and conducting security awareness training to educate employees about email-based threats.

Sources: ESET, ESET(1), ESET(2)

More from

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today