Turla espionage campaign using Cereal toolkit against Microsoft Exchange
2 TTPsThe Turla threat actor is deploying a custom malware suite dubbed Cereal to compromise Microsoft Exchange servers and intercept government email correspondence by embedding directly into legitimate Exchange processes.
Snake Malware Persistence via Malicious Windows Service
1 rule 2 TTPsSnake malware achieves persistence by installing a rogue Windows service named 'WerFaultSvc' that masquerades within the Windows WinSxS directory.
Targeting and Compromise of French Entities Using the Turla Intrusion Set
The Turla intrusion set, operated by the 16th Centre of the Federal Security Service (FSB) of Russia, has been targeting French entities and other strategic organizations globally since at least 2004 for intelligence-gathering purposes, with victims in France including ministries and entities within the diplomatic, defence, justice, and technology sectors.
Targeting and Compromise of French Entities using the Turla Attack Method
1 TTPThe Turla APT group, attributed to the 16th Center of Russia's Federal Security Service (FSB), has been observed targeting and compromising French entities since at least 2004 for intelligence gathering, impacting ministries and organizations in diplomatic, defense, justice, and technology sectors, with ongoing campaigns against NATO and EU countries.
Secret Blizzard Upgrades Kazuar Backdoor to Modular P2P Botnet
2 rules 4 TTPsThe Russian hacker group Secret Blizzard has evolved the Kazuar backdoor into a modular P2P botnet designed for persistence, stealth, and data collection, utilizing kernel, bridge, and worker modules for command and control and data exfiltration.