Rewterz Threat Alert – Turla APT Group – IOCs

Severity

High

Analysis Summary

The APT group Turla is known by many names including Krypton, MAKERSMARK, Snake, Uroburosk, Venomous Bear, Waterbug and WhiteBear, and is tracked by researchers. Turla is primarily known for its espionage activities. This time they’re back with the another malicious sample dropping malicious exe file samples to different users. Believed to be sponsored by the Russian FSB security service, Turla has been active since at least 2008 and while constantly evolving its own toolkit, has also been turning its attention towards the infrastructure and resources of other APTs.

Impact

Information theft and espionage

Indicators of Compromise

Filename

AgentSvc[.]exe

MD5

3cd389c05ec3383cc2572f305b640168

SHA-256

48dced47372853658202b286920bb4fd0ab16de7c5d5b736eac84eee023d569f

SHA1

7e3bd851b26e827a97052b14c65febfce81fe960

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo