Article Details
Scrape Timestamp (UTC): 2024-03-21 16:05:20.930
Source: https://thehackernews.com/2024/03/russia-hackers-using-tinyturla-ng-to.html
Original Article Text
Click to Toggle View
Russia Hackers Using TinyTurla-NG to Breach European NGO's Systems. The Russia-linked threat actor known as Turla infected several systems belonging to an unnamed European non-governmental organization (NGO) in order to deploy a backdoor called TinyTurla-NG. "The attackers compromised the first system, established persistence and added exclusions to antivirus products running on these endpoints as part of their preliminary post-compromise actions," Cisco Talos said in a new report published today. "Turla then opened additional channels of communication via Chisel for data exfiltration and to pivot to additional accessible systems in the network." There is evidence indicating that the infected systems were breached as early as October 2023, with Chisel deployed in December 2023 and data exfiltrating taking place via the tool a month later, around January 12, 2024. TinyTurla-NG was first documented by the cybersecurity company last month after it was found to be used in connection with a cyber attack targeting a Polish NGO working on improving Polish democracy and supporting Ukraine during the Russian invasion. Cisco Talos told The Hacker News at the time that the campaign appears to be highly targeted and focused on a small number of organizations, most of which are located in Poland. The attack chain involves Turla exploiting their initial access to configure Microsoft Defender antivirus exclusions to evade detection and drop TinyTurla-NG, which is then persisted by creating a malicious "sdm" service that masquerades as a "System Device Manager" service. TinyTurla-NG acts as a backdoor to conduct follow-on reconnaissance, exfiltrate files of interest to a command-and-control (C2) server, and deploy a custom-built version of the Chisel tunneling software. "Once the attackers have gained access to a new box, they will repeat their activities to create Microsoft Defender exclusions, drop the malware components, and create persistence," Talos researchers said. Goodbye, Atlassian Server. Goodbye… Backups? Protect your data on Atlassian Cloud from disaster with Rewind's daily backups and on-demand restores. Take Action Fast with Censys Search for Security Teams Stay ahead of advanced threat actors with best-in-class threat intelligence from Censys Search.
Daily Brief Summary
The Russia-linked Turla group compromised systems at a European NGO to implant the TinyTurla-NG backdoor.
Initial system breach and establishment of persistence were observed, with antivirus exclusions set to aid in avoiding detection.
Turla utilized the tool Chisel for data exfiltration and lateral movement within the compromised network since October 2023.
The attack appears highly targeted, primarily affecting Polish organizations aiding Ukrainian efforts against the Russian invasion.
The attackers configured Microsoft Defender to exclude their tools, then established persistence by mimicking a "System Device Manager" service.
TinyTurla-NG enables ongoing reconnaissance, file exfiltration, and the deployment of a modified Chisel tunneling software for C2 communication.
Repeat of the attack methodology was noted across newly accessed systems, using the same pattern of setting exclusions, dropping malware, and ensuring persistence.
The incident exemplifies sophisticated nation-state level cyber espionage focused on entities engaged in supporting geopolitical adversaries.