Forest Global Training Partners

Cyber Risks · Cisco Talos

Tiny Turla-NG in-depth tooling and command and control analysis

Summary: Cisco Talos, working with CERT.NGO, uncovered new Turla APT tooling including a PHP-based command-and-control script that doubles as a web shell and handles TinyTurla-NG and TurlaPower-NG implant traffic through HTTP form values such as task, cat_file, rm_file and get_result. The actors also deployed a modified UPX-compressed Chisel tunneling tool at C:\Windows\System32\TrustedWorker[.]exe that opens a reverse SOCKS proxy to 91[.]193[.]18[.]120:443 using an embedded TLS certificate valid from Dec. 7, 2023 to Dec. 16, 2024, plus a privilege-impersonation executable compiled in early 2022 and a PowerShell script that archives Microsoft Edge login data into a ZIP file under C:\windows\temp.

What's compelling: Turla ran its command channel through websites it had compromised rather than servers it owned, so the HTTPS traffic blending into those legitimate sites is the same traffic your perimeter already trusts. The hardcoded paths in the enumeration and exfiltration scripts pointed at files maintained by Polish NGOs, and the actors also pulled Firefox profile data, which means the stolen material was the day-to-day operational documents and stored credentials of a specific set of victims.

Read the original at Cisco Talos ↗

Topics
Malware
Related