Friday, May 24, 2024

Cyber Espionage: Turla APT Hackers Attack European Organization With Backdoor

Cybersecurity experts have uncovered a failed attempt by the notorious Russia-based Turla Advanced Persistent Threat (APT) group to infiltrate an Albanian organization.

This incident is part of a broader cyber espionage campaign targeting European countries, with Poland also falling victim to these sophisticated attacks.

The discovery aligns with the ongoing geopolitical tensions and highlights state-aligned actors’ escalating cyber warfare tactics.

Are you from the SOC and DFIR Teams? – Analyse linux Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.

The Failed Infiltration

On March 26, a user located in Albania uploaded a file to the VirusTotal web interface, which revealed the attempted breach in Albania.

The file, named “Firewall_Bllok_IP.txt.txt,” contained a list of IP addresses, including the address 91[.]193[.]18[.]120.

Cisco Talos has flagged this particular IP as a command and control server associated with the “TinyTurla-NG” (TTNG) backdoor, marking it as a key indicator of compromise.

Unique file uploaded manually from Albania-based IP address on March 26 to the VirusTotal user web interface
with ”bllok”(block) written in Albanian.

Analysis of the file confirmed its authenticity. Multiple antivirus vendors recognized all listed IP addresses as malicious.

Turla APT
The plaintext file only lists IP addresses

Turla APT’s Expanding Campaign

The Turla APT group, known for its sophisticated cyber espionage operations, has historically targeted organizations with links to government sectors across Baltic and Eastern European countries.

The recent activities in Albania and Poland underscore the group’s ongoing efforts to gather intelligence and exert influence amidst the broader context of the war in Ukraine.

These incidents provide crucial insights into the possible scope of Russia-based APT operations, which continue to pose a significant threat to European security.

Implications for European Security

The targeting of Albania by the Turla APT group is a stark reminder of the persistent cyber threats facing European organizations.

These entities often possess valuable information and maintain critical infrastructure, so they are high-value targets for espionage activities.

The incident underscores the need for heightened cybersecurity measures and international cooperation to counteract the sophisticated tactics employed by state-aligned APT groups.

Looking Ahead

The cybersecurity community remains vigilant as the Turla APT group continues to refine its tactics and target European organizations.

The failed attempt in Albania is a critical reminder of the ongoing cyber warfare landscape, where information is a valuable commodity, and security is perpetually at risk.

With the geopolitical tensions showing no signs of abating, European organizations must remain on high alert and prioritize cybersecurity to thwart future espionage attempts by state-aligned actors.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles