Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

guest · Aug 22, 2018

Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence
August 22, 2018
https://www.bleepingcomputer.com/ne...s-clever-tactics-for-stealth-and-persistence/

The Outlook backdoor used by Turla APT group for its espionage operations is an unusual beast built for stealth and persistence, capable to survive in highly restricted networks.

The malware does not connect to a command and control server and can receive updates and instructions via PDF files delivered to the victim’s email address. Its control depends only on an email exchange that can originate from any address the attacker chooses.

“From the PDF documents, the backdoor is able to recover what attackers call a container in the logs. This is a binary blob with a special format that contains encrypted commands for the backdoor,” ESET analysts explain in a report released today.

The complexity of the Outlook backdoor component is also visible in its encryption algorithm. Just like other tools bearing the Turla signature, the backdoor uses a less common algorithm, which suffered customizations from the developer.
[...] With no command and control server to take down [...] Turla’s Outlook backdoor proves difficult to fight.
Click to expand...

Rasheed187 · Aug 25, 2018

Pretty nifty attack, I guess it would not have worked with web-mail.

Log in or Sign up

Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Turla Outlook Backdoor Uses Clever Tactics for Stealth and Persistence

guest Guest

Rasheed187 Registered Member

Useful Searches