Turla

Data from Local System

Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019)

Data from Removable Media

Turla RPC backdoors can collect files from USB thumb drives.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Databases

Turla has used a custom .NET tool to collect documents from an organization's internal central database.(Citation: ESET ComRAT May 2020)

Archive via Utility

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.(Citation: Symantec Waterbug Jun 2019)

Web Protocols

Turla has used HTTP and HTTPS for C2 communications.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)

Mail Protocols

Turla has used multiple backdoors which communicate with a C2 server via email attachments.(Citation: Crowdstrike GTR2020 Mar 2020)

Proxy

Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)

Internal Proxy

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos TinyTurla September 2021)

Web Service

Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.(Citation: Accenture HyperStack October 2020)(Citation: ESET Crutch December 2020)

Bidirectional Communication

A Turla JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)

Ingress Tool Transfer

Turla has used shellcode to download Meterpreter after compromising a victim.(Citation: ESET Turla Mosquito May 2018)

Brute Force

Turla may attempt to connect to systems within a victim's network using <code>net use</code> commands and a predefined list or collection of passwords.(Citation: Kaspersky Turla)

Windows Credential Manager

Turla has gathered credentials from the Windows Credential Manager tool.(Citation: Symantec Waterbug Jun 2019)

Modify Registry

Turla has modified Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Code Signing Policy Modification

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)

Disable or Modify Tools

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.(Citation: ESET Turla PowerShell May 2019)

System Service Discovery

Turla surveys a system upon check-in to discover running services and associated processes using the <code>tasklist /svc</code> command.(Citation: Kaspersky Turla)

Query Registry

Turla surveys a system upon check-in to discover information in the Windows Registry with the <code>reg query</code> command.(Citation: Kaspersky Turla) Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)

System Network Configuration Discovery

Turla surveys a system upon check-in to discover network configuration details using the <code>arp -a</code>, <code>nbtstat -n</code>, <code>net config</code>, <code>ipconfig /all</code>, and <code>route</code> commands, as well as NBTscan.(Citation: Kaspersky Turla)(Citation: Symantec Waterbug Jun 2019)(Citation: ESET ComRAT May 2020) Turla RPC backdoors have also retrieved registered RPC interface information from process memory.(Citation: ESET Turla PowerShell May 2019)

Internet Connection Discovery

Turla has used <code>tracert</code> to check internet connectivity.(Citation: ESET ComRAT May 2020)

Remote System Discovery

Turla surveys a system upon check-in to discover remote systems on a local network using the <code>net view</code> and <code>net view /DOMAIN</code> commands. Turla has also used <code>net group "Domain Computers" /domain</code>, <code>net group "Domain Controllers" /domain</code>, and <code>net group "Exchange Servers" /domain</code> to enumerate domain computers, including the organization's DC and Exchange Server.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)

System Network Connections Discovery

Turla surveys a system upon check-in to discover active local network connections using the <code>netstat -an</code>, <code>net use</code>, <code>net file</code>, and <code>net session</code> commands.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020) Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the <code>GetTcpTable2</code> API call.(Citation: ESET Turla PowerShell May 2019)

Process Discovery

Turla surveys a system upon check-in to discover running processes using the <code>tasklist /v</code> command.(Citation: Kaspersky Turla) Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)

Local Groups

Turla has used <code>net localgroup</code> and <code>net localgroup Administrators</code> to enumerate group information, including members of the local administrators group.(Citation: ESET ComRAT May 2020)

Domain Groups

Turla has used <code>net group "Domain Admins" /domain</code> to identify domain administrators.(Citation: ESET ComRAT May 2020)

System Information Discovery

Turla surveys a system upon check-in to discover operating system configuration details using the <code>systeminfo</code> and <code>set</code> commands.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)

File and Directory Discovery

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020) Turla RPC backdoors have also searched for files matching the <code>lPH*.dll</code> pattern.(Citation: ESET Turla PowerShell May 2019)

Local Account

Turla has used <code>net user</code> to enumerate local accounts on the system.(Citation: ESET ComRAT May 2020)(Citation: ESET Crutch December 2020)

Domain Account

Turla has used <code>net user /domain</code> to enumerate domain accounts.(Citation: ESET ComRAT May 2020)

Peripheral Device Discovery

Turla has used <code>fsutil fsinfo drives</code> to list connected drives.(Citation: ESET ComRAT May 2020)

System Time Discovery

Turla surveys a system upon check-in to discover the system time by using the <code>net time</code> command.(Citation: Kaspersky Turla)

Password Policy Discovery

Turla has used <code>net accounts</code> and <code>net accounts /domain</code> to acquire password policy information.(Citation: ESET ComRAT May 2020)

Security Software Discovery

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.(Citation: ESET ComRAT May 2020)

Group Policy Discovery

Turla surveys a system upon check-in to discover Group Policy details using the <code>gpresult</code> command.(Citation: ESET ComRAT May 2020)

PowerShell

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject.(Citation: ESET Turla Mosquito May 2018)(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019) Turla has also used PowerShell scripts to load and execute malware in memory.

Windows Command Shell

Turla RPC backdoors have used cmd.exe to execute commands.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Visual Basic

Turla has used VBS scripts throughout its operations.(Citation: Symantec Waterbug Jun 2019)

Python

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.(Citation: Unit 42 IronNetInjector February 2021 )

JavaScript

Turla has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018)

Native API

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.(Citation: ESET Turla PowerShell May 2019)

Malicious Link

Turla has used spearphishing via a link to get users to download and run their malware.(Citation: ESET Turla Mosquito Jan 2018)

Exfiltration to Cloud Storage

Turla has used WebDAV to upload stolen USB files to a cloud drive.(Citation: Symantec Waterbug Jun 2019) Turla has also exfiltrated stolen files to OneDrive and 4shared.(Citation: ESET ComRAT May 2020)

Drive-by Compromise

Turla has infected victims using watering holes.(Citation: ESET ComRAT May 2020)(Citation: Secureworks IRON HUNTER Profile)

Spearphishing Link

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.(Citation: ESET Turla Mosquito Jan 2018)

SMB/Windows Admin Shares

Turla used <code>net use</code> commands to connect to lateral systems within a network.(Citation: Kaspersky Turla)

Lateral Tool Transfer

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Registry Run Keys / Startup Folder

A Turla Javascript backdoor added a local_update_check value under the Registry key <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run</code> to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)(Citation: ESET Turla Lunar toolset May 2024)

Winlogon Helper DLL

Turla established persistence by adding a Shell value under the Registry key <code>HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</code>.(Citation: ESET Turla Mosquito Jan 2018)

Exploitation for Privilege Escalation

Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.(Citation: Unit42 AcidBox June 2020)

Windows Management Instrumentation Event Subscription

Turla has used WMI event filters and consumers to establish persistence.(Citation: ESET Turla PowerShell May 2019)

PowerShell Profile

Turla has used PowerShell profiles to maintain persistence on an infected machine.(Citation: ESET Turla PowerShell May 2019)

Web Services

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.(Citation: ESET Crutch December 2020)

Virtual Private Server

Turla has used the VPS infrastructure of compromised Iranian threat actors.(Citation: NSA NCSC Turla OilRig)

Server

Turla has used compromised servers as infrastructure.(Citation: Recorded Future Turla Infra 2020)(Citation: Accenture HyperStack October 2020)(Citation: Talos TinyTurla September 2021)

Web Services

Turla has frequently used compromised WordPress sites for C2 infrastructure.(Citation: Recorded Future Turla Infra 2020)

Malware

Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)

Malware

Turla has used malware obtained after compromising other threat actors, such as OilRig.(Citation: NSA NCSC Turla OilRig)(Citation: Recorded Future Turla Infra 2020)

Tool

Turla has obtained and customized publicly-available tools like Mimikatz.(Citation: Symantec Waterbug Jun 2019)

Indicator Removal from Tools

Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.(Citation: ESET Gazer Aug 2017)

Command Obfuscation

Turla has used encryption (including salted 3DES via PowerSploit's <code>Out-EncryptedScript.ps1</code>), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.(Citation: ESET Turla PowerShell May 2019)

Fileless Storage

Turla has used the Registry to store encrypted and encoded payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Match Legitimate Resource Name or Location

Turla has named components of LunarWeb to mimic Zabbix agent logs.(Citation: ESET Turla Lunar toolset May 2024)

Process Injection

Turla has also used PowerSploit's <code>Invoke-ReflectivePEInjection.ps1</code> to reflectively load a PowerShell payload into a random process on the victim system.(Citation: ESET Turla PowerShell May 2019)

Dynamic-link Library Injection

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.(Citation: ESET Turla Mosquito May 2018)(Citation: Github Rapid7 Meterpreter Elevate)

Local Accounts

Turla has abused local accounts that have the same password across the victim’s network.(Citation: ESET Crutch December 2020)

Create Process with Token

Turla RPC backdoors can impersonate or steal process tokens before executing commands.(Citation: ESET Turla PowerShell May 2019)

Deobfuscate/Decode Files or Information

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)

File/Path Exclusions

Turla has placed LunarWeb install files into directories that are excluded from scanning.(Citation: ESET Turla Lunar toolset May 2024)