Loading malware…
TinyTurla is a Turla-associated Windows backdoor used for long-term covert access and persistence. It has been documented as a 64-bit service DLL that runs under svchost.exe and is installed through a Windows service, allowing it to blend with legitimate system activity. The malware is linked to the Russian espionage group Turla, also known for targeting government, embassy, military, education, research, telecommunications, and non-governmental organizations, including more recent activity against Polish NGOs supporting Ukraine.
TinyTurla stores and retrieves operational configuration from the Windows Registry, including command-and-control server information, timing parameters, and an authentication value. It communicates with command-and-control infrastructure over HTTPS using WinHTTP and can ignore SSL validation errors, providing encrypted network communications while reducing operator friction when using compromised or irregular infrastructure. The malware fingerprints the host using system-specific identifiers and includes logic to authenticate with its controller before accepting further tasking.
Core functionality includes remote command execution, process creation, termination of spawned processes, file creation, file upload from the victim, and interactive pipe-based process I/O. Documented command handling supports executing commands directly, launching subprocesses with redirected input and output, reading local files for exfiltration, writing attacker-supplied content to disk, and updating its own registry-based configuration in place. This design allows operators to maintain access, adapt beacon timing, rotate infrastructure, and preserve a fallback foothold on compromised systems.
Related reporting describes a newer variant, TinyTurla-NG, as a lightweight “last chance” backdoor used when other access mechanisms fail or are detected. That variant has been observed using compromised WordPress sites as command-and-control nodes, executing tasks through cmd.exe or PowerShell, downloading and uploading files, changing timing and shell behavior, and deleting itself. Associated PowerShell tooling has been used to collect and exfiltrate files, including material relevant to password database protection, indicating credential-theft objectives in some operations.
Across reporting, TinyTurla and closely related implants consistently emphasize stealthy service-based persistence, registry-backed configuration, encrypted command-and-control, and flexible post-compromise task execution in support of Russian state-aligned espionage operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style and functionality implementation.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
It creates a scheduled task to execute the newly generated log file using “MSBuild.exe” in the background every 20 minutes.
shell : This operation enables the backdoor to execute commands on the victim’s machine.
When a user executes the .LNK file, it triggers the execution of a PowerShell script embedded within it.
1st byte = 0x01 – create a process... The binary creates a process specified by the C2 server in the response... 1st byte = 0x02 – create a process and exfiltrate its output... 1st byte = 0x05 – spawn a new process
Additionally, the PowerShell script executes the MSBuild project using “MSBuild.exe”... This ability to execute code in memory enables TAs to utilize MSBuild in fileless attacks.
When a user executes the .LNK file, it triggers the execution of a PowerShell script embedded within it.
The malware implements 12 different commands that include... creating pipes for process communication... The malicious file creates an anonymous pipe... The process reads data that is available through the pipe using the PeekNamedPipe and ReadFile APIs.
It creates a scheduled task to execute the newly generated log file using “MSBuild.exe” in the background every 20 minutes.
The list of C2 servers and a password used for authentication with the servers are stored in the Windows registry... 1st byte = 0x08 – modify the “TimeLong” registry value... 0x09 – modify the “TimeShort” registry value... 0x0A – modify the “Security” registry value... 0x0B – modify the “Hosts” registry value.
Examples include: “ComRAT has encrypted and stored its orchestrator code in the Registry…”, “ShadowPad maintains a configuration block and virtual file system in the Registry.”, and “QakBot can store its configuration information…under HKCU\Software\Microsoft.”
CRIL identified a campaign utilizing malicious .LNK files masquerading as a PDF document.
Akira has used legitimate names and locations for files to evade defenses.
Additionally, the PowerShell script executes the MSBuild project using “MSBuild.exe”... This ability to execute code in memory enables TAs to utilize MSBuild in fileless attacks.
Using the rijndael algorithm, it decrypts the retrieved encrypted content.
The list of C2 servers and a password used for authentication with the servers are stored in the Windows registry... 1st byte = 0x08 – modify the “TimeLong” registry value... 0x09 – modify the “TimeShort” registry value... 0x0A – modify the “Security” registry value... 0x0B – modify the “Hosts” registry value.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The C2 domain, hxxps[://]cache[.]chartbaet[.]com/static/cache/, is XOR encoded... leverages the user agent [Mozilla/5.0 ... Chrome/93.0.4577.63 Safari/537.36].
it has been observed how in servers infected by this threat, command and controls from other Turla tools have been deployed in order to use them as infrastructure in recent campaigns.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Turla backdoor used to maintain secret persistent access on victim machines.
A lightweight backdoor delivered via malicious LNK and MSBuild project files. It executes in memory, persists via scheduled tasks, hides MSBuild windows, generates a unique victim ID, communicates with a C2 over HTTP, and supports shell execution, sleep interval changes, file upload/download, directory changes, and PowerShell execution.
A previously disclosed Turla implant/backdoor referenced as the predecessor and close analogue to TinyTurla-NG, also described as a small 'last chance' backdoor.
A Turla backdoor previously reported by Cisco Talos, described here as a stealth backdoor used to maintain secret access to victim machines and used for comparison with the newly observed sample.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.