The Turla spy group attacked a foreign ministry in an EU country. ESET researchers analyze previously unknown backdoor.
The well-known APT group Turla was active again. ESET researchers have discovered that the hackers have gained access to the network of a foreign ministry in an EU country. A sophisticated espionage program called Crutch was used. The malware is a backdoor and is used to steal sensitive documents. The security experts of the European IT security manufacturer found numerous indications that the Turla Group was the mastermind.
Tasks of the espionage program
The special location underpins the suspicion that Crutch is only used against very specific high-profile targets. The task of the espionage program is to smuggle sensitive documents and other files into Dropbox accounts that are controlled by the hackers. The ESET researchers have now published their detailed analysis of Crutch on the WeliveSecurity blog.
“Crutch's main job is to exfiltrate sensitive information from the organization. Due to the sophistication and the technical details, we assume that the Turla group was behind the attacks, ”explains Matthieu Faou, one of the ESET researchers involved. “In addition, the espionage program is able to bypass some security systems. The hackers abuse a legitimate infrastructure, in this case Dropbox, to insert themselves into normal network traffic. In this way, documents can be channeled out unnoticed and new commands can be entered by the operators. "
Crutch malware activity
In order to be able to trace the activities of the espionage program, the ESET researchers checked when zip files were uploaded to the Dropbox accounts. The graphic shows that Crutch was most active when the highest network traffic was generated in the target organization during general working hours. Discovery was more difficult that way.
Who is Turla?
Turla has been an active cyber spy group for more than 10 years. The APT group has compromised many governments, especially diplomatic institutions, around the world and operates a large malware arsenal that ESET has documented over the past few years.
Find out more on WeLiveSecurity at ESET.com
About ESET ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.