Loading story…
ESET reported that the Turla espionage group deployed a unique backdoor that abused Microsoft Outlook to conduct covert operations against targets in Europe. The malware used Outlook as a communications channel, allowing operators to hide command-and-control activity inside normal email traffic and blend malicious actions with legitimate enterprise workflows.
The campaign was aimed at European institutions, underscoring Turla’s continued focus on long-term intelligence collection against government and diplomatic targets. By leveraging a trusted application already embedded in many organizations, the attackers reduced the likelihood of detection while maintaining persistent access for surveillance and data theft.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET publicly reported on a unique Outlook-based backdoor used by the Turla APT group to spy on European government and diplomatic institutions. The disclosure described the malware's use of Microsoft Outlook functionality for command-and-control and data theft.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **Turla** espionage group deployed a stealthy backdoor that abuses **Microsoft Outlook**—and in older cases, **The Bat!** email client—as its command-and-control channel. The malware uses **MAPI** to access a victim’s mailbox without prompting for credentials, forwards outgoing messages to attacker-controlled addresses, records metadata from incoming mail, and hides within normal communications by sending stolen data in specially crafted **PDF attachments** while also receiving commands through PDFs. The backdoor was linked to compromises involving the **German Foreign Office**, two other European foreign ministries, and a large defense contractor, with activity traced back to at least **2013**. ESET said the malware maintains persistence in Outlook through **per-user COM object hijacking** and includes multiple stealth features, including deleting attacker-related emails and suppressing Outlook notifications; researchers also noted that its command mechanism lacks sender authentication, creating a risk that other attackers could potentially hijack already infected systems if they know the command format.
Aug 15, 2026
ESET disclosed **Gazer**, a previously undocumented second-stage backdoor attributed to the **Turla** cyberespionage group, describing its use in targeted intrusions against governments, diplomats, embassies, consulates, and ministries. The victims were concentrated in Europe, with a particular focus on Southeastern Europe and countries of the former Soviet Union, and the malware had reportedly been active since at least 2016. The backdoor was built for long-term covert access, using code-string changes, randomized markers, and secure file wiping to reduce detection while stealing information over extended periods. According to ESET, Turla typically began operations with spearphishing that deployed a first-stage implant such as **Skipper**, then escalated to stealthier payloads including **Gazer**, **Carbon**, or **Kazuar**, while relaying command-and-control traffic through compromised legitimate websites.
Aug 14, 2026
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026