Turla is a high-profile Russian-speaking threat actor with a known interest in cyberespionage against government and diplomatic related targets. It has a reputation for being innovative and for its signature KopiLuwak malware, first observed in late 2016. In 2019, Kaspersky researchers uncovered new tools and techniques introduced by the threat actor that increase stealth and help to minimise detection.
KopiLuwak is designed for cyberespionage and Turla’s latest infection process includes techniques that help the malware to avoid detection. For example, the command and control infrastructure has IPs that appear to mimic ordinary LAN addresses. Further, the malware is almost completely ‘fileless’ – the final stage of infection, an encrypted Trojan for remote administration, is embedded into the computer’s registry for the malware to access when ready.
The two KopiLuwak analogues: the .NET RocketMan Trojan and the PowerShell MiamiBeach Trojan are also designed for cyberespionage. Researchers believe that these versions are deployed against targets with security software installed that is able to detect KopiLuwak. Upon successful installation, all three versions can:
“In 2019, Turla emerged with a revamped toolset, introducing a number of new features possibly to minimise detection by security solutions and researchers. These include reducing the malware’s digital footprint and the creation of two different but similar versions of the well-known KopiLuwak malware. The abuse of installation packs for VPN software that can circumvent internet censorship suggests the attackers have clearly defined cyberespionage targets for these tools. The continued evolution of Turla’s arsenal is a good reminder of the need for threat intelligence and security software that can protect against the latest tools and techniques used by APTs. For example, endpoint protection and checking file hashes after downloading installation software would help to protect against threats like Topinambour,” said Kurt Baumgartner, Principal Security Researcher at Kaspersky.