Loading story…
Kaspersky researchers reported that the Turla espionage group used commercial satellite internet connections to hide command-and-control traffic for malware operations. The attackers abused downstream-only satellite links and spoofed victim IP addresses so infected systems appeared to communicate with legitimate satellite subscribers, making the true location of the operators difficult to trace and allowing the infrastructure to blend into normal network noise.
The technique was tied to long-running Turla intrusions against government, military, diplomatic, and research targets, and showed a high level of operational security rather than a new malware family alone. By routing traffic through satellite providers and disposable access points, the group reduced attribution risk and complicated incident response, highlighting how advanced threat actors can combine conventional malware with unconventional communications infrastructure to sustain covert espionage campaigns.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published research describing the 'Satellite Turla' operation, detailing how the Turla APT used hijacked satellite internet links for command-and-control to help obscure its infrastructure.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigators at Sophos X-Ops uncovered a long-running intrusion at a telecommunications company involving a stealthy backdoor they named **NotSoTinyTurla**, citing code and tradecraft overlaps with malware previously associated with **Turla**. The malicious component was identified as `smpsvc.dll`, likely resident since at least June 2022, and configured to launch via the legitimate `smphost` service so it could run covertly inside `svchost.exe`. Sophos said the malware used an obfuscated loader, generated unique command-and-control URLs, and reached out to infrastructure disguised as a Chartbeat domain before injecting its final payload directly into memory while obscuring API calls. After establishing command and control, the intruders appeared to conduct a **DCSync** credential-theft operation and host discovery using **Impacket**, indicating an effort to expand access inside the victim environment. Investigators also found that the attackers created an `SRService` service to deploy **cloudflared** and maintain persistence through a Cloudflare Tunnel, a technique Sophos linked to prior Turla tradecraft. The findings add to the body of reporting on Turla’s multi-stage backdoor ecosystem, including earlier research into the group’s second-stage tooling such as **Carbon**, and suggest the actor continues to adapt established espionage methods for covert access and persistence.
Aug 15, 2026
Researchers linked multiple generations of **Turla** malware—including **Agent.BTZ**, **ComRAT**, **Uroburos/Snake**, and **TinyTurla**—to a long-running cyber-espionage operation that continued to evolve its tooling while preserving technical ties to earlier campaigns. Newer **ComRAT** samples were identified alongside more than 70 previously unknown IP and DNS indicators, with the malware delivered through a fake WinRAR self-extracting installer, loading a proxy DLL (`activeds.dll`) and a main payload (`stdole2.tlb`) into `explorer.exe`. Analysts also documented overlaps between Agent.BTZ and later Turla tooling, including reused XOR keys, shared artifacts, and code similarities, reinforcing the view that older Pentagon-breach-era malware remained influential in Turla’s later implants.
Aug 15, 2026
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026