Turla Uses TinyTurla-NG Backdoor to Target Polish NGOs and Steal Password-Manager Key Material
Summary
Cisco Talos details Turla’s TinyTurla-NG backdoor campaign targeting Polish NGOs, using compromised WordPress sites for C2 and PowerShell scripts to collect and exfiltrate files, including password-manager key material.
Key points
- Talos observed TinyTurla-NG activity from at least December 2023 through January 27, 2024, targeting Polish NGOs, including an organization supporting Ukraine.
- The backdoor runs as a service DLL via svchost.exe, contacts C2 servers, and executes operator-supplied commands through PowerShell or cmd.exe.
- TinyTurla-NG supports remote tasking, file downloads and uploads, shell changes, and deletion of files; its PowerShell execution disables command-history saving.
- Turla used compromised WordPress websites as C2 endpoints, with PHP scripts handling tasking, logging, and data storage.
- TurlaPower-NG scripts recursively archive selected files and send the archives to C2 over HTTP/S, with a focus on key material protecting password-manager databases.
- Talos identified three TinyTurla-NG samples and assessed the backdoor as a fallback implant used when other access mechanisms fail or are detected.
Article Details
- Attack Vectors
- Turla used compromised, vulnerable WordPress-based websites to host PHP command-and-control scripts for TinyTurla-NG.
- TinyTurla-NG beaconed to its C2, retrieved tasks, and executed attacker-supplied commands using PowerShell or cmd.exe.
- TinyTurla-NG fetched files over HTTP GET and exfiltrated files to its C2; TurlaPower-NG archived selected files, including password-manager key material, and uploaded the archives using HTTP/S POST.
- The backdoor's killme command deleted files and removed a registry key under HKCU\Software\Classes\CLSID, then restarted explorer.exe; Talos describes this as an attempted COM-hijacking persistence mechanism.
- Defensive Notes
- Talos recommends detecting and blocking the malware and malicious websites using endpoint, web, email, firewall, and malware-analysis protections, and keeping Snort rules up to date.
- Cisco Duo multi-factor authentication is cited as a protection to ensure only authorized users access the network.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | buy-new-car[.]com | Domain listed by Talos as an IOC for this research. |
| DOMAIN | caduff-sa[.]ch | Domain listed by Talos as an IOC for this research. |
| DOMAIN | carleasingguru[.]com | Domain listed by Talos as an IOC for this research. |
| DOMAIN | hanagram[.]jp | Domain listed by Talos as an IOC for this research. |
| DOMAIN | jeepcarlease[.]com | Domain listed by Talos as an IOC for this research. |
| DOMAIN | thefinetreats[.]com | Domain listed by Talos as an IOC for this research. |
| SHA256 | 267071df79927abd1e57f57106924dd8a68e1c4ed74e7b69403cdcdf6e6a453b | Hash listed by Talos as an IOC for this research. |
| SHA256 | d6ac21a409f35a80ba9ccfe58ae1ae32883e44ecc724e4ae8289e7465ab2cf40 | Hash listed by Talos as an IOC for this research. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelTinyTurla-NG and TurlaPower-NG send files, including archived data, to the C2.T1059.001 · PowerShellTinyTurla-NG executes C2-provided tasks using PowerShell.T1059.003 · Windows Command ShellTinyTurla-NG executes C2-provided tasks using cmd.exe.T1070.004 · File DeletionThe killme command uses a batch file to delete files from the victim machine.T1105 · Ingress Tool TransferThe backdoor fetches files from its C2 using HTTP GET.T1546.015 · Component Object Model HijackingThe killme batch script deletes a CLSID registry key and restarts explorer.exe; Talos identifies this as an attempt at COM hijacking for persistence.
People
Threat Actors
Malware
CAPIBARincluding the U.S., European Union, Ukraine and Asia. They’ve previously used malware families such as CAPIBAR and KAZUAR to target Ukrainian defense forces. After Crutch and TinyTurla, Turla has now expanded itsCrutchpreviously used malware families such as CAPIBAR and KAZUAR to target Ukrainian defense forces. After Crutch and TinyTurla, Turla has now expanded its arsenal to include the TinyTurla-NG and TurlaPower-NG malwareKazuarthe U.S., European Union, Ukraine and Asia. They’ve previously used malware families such as CAPIBAR and KAZUAR to target Ukrainian defense forces. After Crutch and TinyTurla, Turla has now expanded its arsenal toTinyTurlaTinyTurla Next Generation - Turla APT spies on Polish NGOsTinyTurla-NGby the Turla APT group, a Russian cyber espionage threat group. This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style andTurlaPower-NGWe’ve also discovered previously unknown PowerShell scripts we’re calling “TurlaPower-NG '' that are meant to act as file exfiltrators. TinyTurla-NG deployed these scripts to exfiltrate key material used to secure the
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.WordPressIn this campaign, Turla uses compromised WordPress-based websites as command and control endpoints (C2) for the TTNG backdoor. The operators used different websites running vulnerable WordPress versions (versions
Countries
PolandRussiathe adversary’s intention to expand both their suite of malware as well as a set of targets to support Russia’s strategic and political goals.UkraineTinyTurla-NG was seen as early as December 2023 targeting a Polish non-governmental organization (NGO) working on improving Polish democracy and supporting Ukraine during the Russian invasion.