Tiny Turla Next Generation - Turla APT spies on Polish NGOs
Summary: Cisco Talos, working with CERT.NGO, investigated a Turla compromise of Polish NGOs, at least one supporting Ukraine, using a new backdoor called TinyTurla-NG that is similar to TinyTurla but with new code. The campaign's earliest compromise was Dec. 18, 2023, and it was active as recently as Jan. 27, 2024, with command and control run through compromised WordPress sites on vulnerable versions including 4.4.20, 5.0.21, 5.1.18 and 5.7.2.
Key Takeaway: Turla used legitimate, vulnerable WordPress websites as C2 endpoints and a PowerShell script, TurlaPower-NG, that archived and exfiltrated files - with specific interest in key material for password databases and password management software - so an unpatched public-facing site can become the channel for stealing your credentials.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026