Forest Global Training Partners

Cyber Risks · Cisco Talos

New details on Tiny Turla’s post-compromise activity reveal full kill chain

Summary: Cisco Talos reported that Turla, a Russian espionage group, first adds Microsoft Defender path exclusions such as C:\Windows\System32\, then writes its TinyTurla-NG implant to disk and persists it via a malicious service named "sdm" posing as "System Device Manager." The implant performs reconnaissance, stages files for exfiltration to its C2, and deploys a Chisel beacon that opens a reverse proxy tunnel and was used to pivot to other systems, with the majority of data exfiltration occurring on Jan. 12, 2024, after compromises dating to October 2023.

Bottom line: Turla disables the antivirus before dropping the backdoor and repeats that same playbook on every new host it reaches, so a single missed exclusion is the difference between one infected machine and an enterprise-wide intrusion. The Chisel tunnel beaconed hourly and carried the bulk of the stolen data months after initial access, meaning dwell time, not the initial compromise, is where the loss occurred.

Read the original at Cisco Talos ↗

Topics
Malware
Related