Loading story…
ESET reported that the Turla espionage group deployed a stealthy backdoor that abuses Microsoft Outlook—and in older cases, The Bat! email client—as its command-and-control channel. The malware uses MAPI to access a victim’s mailbox without prompting for credentials, forwards outgoing messages to attacker-controlled addresses, records metadata from incoming mail, and hides within normal communications by sending stolen data in specially crafted PDF attachments while also receiving commands through PDFs.
The backdoor was linked to compromises involving the German Foreign Office, two other European foreign ministries, and a large defense contractor, with activity traced back to at least 2013. ESET said the malware maintains persistence in Outlook through per-user COM object hijacking and includes multiple stealth features, including deleting attacker-related emails and suppressing Outlook notifications; researchers also noted that its command mechanism lacks sender authentication, creating a risk that other attackers could potentially hijack already infected systems if they know the command format.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
ESET found that a 2018 version of the Turla Outlook backdoor added the ability to run PowerShell commands via Empire PSInject without invoking powershell.exe. This marked a functional enhancement of the implant.
After initially compromising the Federal College of Public Administration, the attackers moved into the German Foreign Office network in March 2017. ESET linked this compromise to the Turla Outlook backdoor.
The German government intrusion was detected by German security services at the end of 2017. The compromise reportedly involved computers at the German Foreign Office.
According to the report, the intrusion affecting the German government began in 2016. The campaign was later associated with Turla's Outlook backdoor activity.
ESET reported that the Turla email-based Outlook backdoor had been observed in real-world use since at least 2013. The implant used email and crafted PDF attachments for command-and-control and data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **Turla** espionage group deployed a unique backdoor that abused Microsoft Outlook to conduct covert operations against targets in Europe. The malware used Outlook as a communications channel, allowing operators to hide command-and-control activity inside normal email traffic and blend malicious actions with legitimate enterprise workflows. The campaign was aimed at **European institutions**, underscoring Turla’s continued focus on long-term intelligence collection against government and diplomatic targets. By leveraging a trusted application already embedded in many organizations, the attackers reduced the likelihood of detection while maintaining persistent access for surveillance and data theft.
Jul 12, 2026
ESET disclosed **Gazer**, a previously undocumented second-stage backdoor attributed to the **Turla** cyberespionage group, describing its use in targeted intrusions against governments, diplomats, embassies, consulates, and ministries. The victims were concentrated in Europe, with a particular focus on Southeastern Europe and countries of the former Soviet Union, and the malware had reportedly been active since at least 2016. The backdoor was built for long-term covert access, using code-string changes, randomized markers, and secure file wiping to reduce detection while stealing information over extended periods. According to ESET, Turla typically began operations with spearphishing that deployed a first-stage implant such as **Skipper**, then escalated to stealthier payloads including **Gazer**, **Carbon**, or **Kazuar**, while relaying command-and-control traffic through compromised legitimate websites.
Aug 14, 2026
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026