Rewterz Threat Alert – Turla group Exploits Their CounterParts

Severity

High

Analysis Summary

The Turla group, also known as Waterbug or VENOMOUS BEAR, is widely reported to be associated with Russian actors. Turla uses a range of tools and techniques to target government, military, technology, energy and commercial organisations for the purposes of intelligence collection. Turla’s use of Neuron and Nautilus implants and an ASPX-based backdoor alongside the Snake rootkit.

After acquiring the tools – and the data needed to use them operationally – Turla first tested them against victims they had already compromised using their Snake toolkit, and then deployed the Iranian tools directly to additional victims. Turla sought to further their access into victims of interest by scanning for the presence of Iranian backdoors and attempting to use them to gain a foothold. The focus of this activity from Turla was largely in the Middle East, where the targeting interests of both Advanced Persistent Threats (APTs) overlap.

Impact

• Remote code execution
• Exfiltrate sensitive documents

Indicators of Compromise

MD5

• d891c9374ccb2a4cae2274170e8644d8
• 60bcc6bc746078d81a9cd15cd4f199bb

SH256

• 83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015
• 51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927

SHA1

• c9fc7ce10aba20894ef914d2073021a48995db17
• 2fb145c64263006a95a0771b57e967977f63954d

Remediation

Block all threat indicators at your respective controls.