Staying ahead of security measures and exploiting new vulnerabilities requires hackers to change their tactics.
By doing so, they manage to bypass better defenses, maximize success rates, and keep on with their illegal activities.
The adaptation of techniques by hackers enables them to continue compromising systems by targeting emerging technologies and adjusting to changes in the digital landscape, which ensures the persistence of their relevance and effectiveness.
Cybersecurity researchers at Cisco Talos recently discovered that TinyTurla evolved their TTPs to stealthily attack enterprise organizations.
Cisco Talo in coordination with CERT.NGO has uncovered new details on the entire kill chain used by the Russian espionage group Turla in an ongoing campaign deploying their TinyTurla-NG (TTNG) implant.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities. :
AcuRisQ, that helps you to quantify risk accurately:
The analysis reveals Turla compromised multiple systems within a European NGO’s network, establishing persistence, disabling anti-virus protections, and using Chisel for data exfiltration and lateral movement to other accessible hosts after the initial breach.
The updated findings provide insights into the tactics, techniques, and procedures employed by this threat actor to steal sensitive information and propagate through infected enterprises.
Turla, a threat group, employs advanced tactics. It configures anti-virus exclusions before deploying the TinyTurla-NG backdoor.
Post-deployment establishes persistence via malicious service. Turla adds exclusions in anti-virus software like Microsoft Defender at locations hosting implants.
It uses batch files creating “sdm” service masquerading as “System Device Manager” for TinyTurla-NG persistence, mirroring 2021 TinyTurla technique. The dual batch file usage seems unnecessarily convoluted for evasion.
Chisel uses asymmetric encryption in an attacker-controlled system to set up a reverse proxy tunnel.
Attackers leverage this initial chisel connection to pivot laterally via WinRM remote sessions, likely facilitated by proxy chains and evil-winrm.
On newly compromised systems, they repeat the cycle – configuring Microsoft Defender exclusions, dropping malware components, and establishing persistence. This adheres to Turla’s methodical cyber kill chain playbook.
Traffic analysis showed Chisel beaconed its C2 server hourly. Though systems were compromised in October 2023 and Chisel deployed by December 2023, Turla operators primarily exfiltrated data over the Chisel C2 channel much later on January 12, 2024.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Brinker, an innovative narrative intelligence platform dedicated to combating disinformation and influence campaigns, has been…
A recent investigation by cybersecurity researchers has uncovered a large-scale malware campaign leveraging the DeepSeek…
A recent malware campaign has been observed targeting the First Ukrainian International Bank (PUMB), utilizing…
A newly discovered malware, dubbed Trojan.Arcanum, is targeting enthusiasts of tarot, astrology, and other esoteric…
A sophisticated phishing campaign orchestrated by a Russian-speaking threat actor has been uncovered, revealing the…
A sophisticated malware campaign has compromised over 1,500 PostgreSQL servers, leveraging fileless techniques to deploy…
![](data:image/svg+xml;charset=utf-8,<svg height="400px" width="1000px" xmlns="http://www.w3.org/2000/svg" version="1.1"/>)
