Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates

The Russian-language speaking advanced persistent threat (APT) group Turla, which appeared to have gone dormant for a while, seems to be back at it again.

In separate advisories, two security vendors this week reported on recent malicious activity that they described as being linked in one way or the other to Turla.

One of the advisories was from ESET and warned about a hitherto undocumented backdoor dubbed Gazer, that members of Turla have begun using relatively recently to spy on embassies and consulates worldwide.

The backdoor is being used in a data-stealing campaign and was discovered on an unspecified number of computers belonging mostly to targets located in Southeastern Europe and member nations of the former Soviet Union.

The other advisory was from Kaspersky Lab and provided details of Turla-related APT activity called WhiteBear that the security vendor had warned its customers about back in mid-February 2017. According to Kaspersky Lab, the WhiteBear campaign appeared to be the second phase of White Atlas, another Turla project that the company had privately warned its customers about in 2016.

As with previous Turla campaigns, WhiteBear's command and control infrastructure also is comprised of a collection of compromised websites and hijacked satellite connections. Some portions of the infrastructure that WhiteBear is using was also used previously in other Turla campaigns, such as one involving a data-stealing backdoor dubbed Kopiluwak.

In addition, attempts to deploy WhiteBear modules are always preceded by attempts to deploy WhiteAtlas as well, further suggesting a link between the two, Kaspersky Lab said.

"The connections appear pretty solid," says Kurt Baumgartner, principal security researcher at Kaspersky Lab, pointing to other similarities such as the use of a shared command and control server and a logging facility that shares components associated with previous Turla campaigns.

Despite such similarities, though, the WhiteBear campaign seems to be a separate and smaller project targeting consular operations, embassies and, starting June, defense organizations as well.

"The target profiles appear to be a subset of what we have seen with WhiteAtlas," Baumgartner says. Several other operations involving WhiteAtlas and other Turla operations also have been broader than what Kaspersky Lab has seen with WhiteBear, he adds.

Meanwhile, Jean-Ian Boutin, senior malware researcher at ESET, says the security vendor was able to tie Gazer to Turla because of its similarities with Carbon and Kazuar - two other backdoors that the Turla group has used. "For example, they can all receive encrypted tasks from a C&C server, which can be executed either by the infected machine or by another compromised machine on the network," he says.

Similarly, all the malware samples use an encrypted container to store the malware’s components and configuration information and to also log their actions in a file, Boutin says. Skipper, yet another backdoor associated with Turla, was found alongside Gazer in most of the cases that ESET investigated, Boutin says.

"Turla is very sophisticated – they are constantly changing their tools to evade detection, and all of their second stage backdoor implements advanced techniques to remain persistent and stealthy on a system," he says.

The alerts from Kaspersky Lab and ESET mark the second and the third time this month that a security vendor has reported on Turla. Earlier, Proofpoint said it had discovered a new JavaScript dropper for the KopiLuwak backdoor being used in a data theft campaign targeting G20 participants. Among those targeted by the campaign that Proofpoint reported were policymakers, journalists, and representatives from G20 member nations.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Related Content: