Loading story…
Investigators at Sophos X-Ops uncovered a long-running intrusion at a telecommunications company involving a stealthy backdoor they named NotSoTinyTurla, citing code and tradecraft overlaps with malware previously associated with Turla. The malicious component was identified as smpsvc.dll, likely resident since at least June 2022, and configured to launch via the legitimate smphost service so it could run covertly inside svchost.exe. Sophos said the malware used an obfuscated loader, generated unique command-and-control URLs, and reached out to infrastructure disguised as a Chartbeat domain before injecting its final payload directly into memory while obscuring API calls.
After establishing command and control, the intruders appeared to conduct a DCSync credential-theft operation and host discovery using Impacket, indicating an effort to expand access inside the victim environment. Investigators also found that the attackers created an SRService service to deploy cloudflared and maintain persistence through a Cloudflare Tunnel, a technique Sophos linked to prior Turla tradecraft. The findings add to the body of reporting on Turla’s multi-stage backdoor ecosystem, including earlier research into the group’s second-stage tooling such as Carbon, and suggest the actor continues to adapt established espionage methods for covert access and persistence.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On September 12, 2023, Sophos observed the legitimate smphost service running inside svchost.exe to load the malicious smpsvc.dll and execute attacker commands. This behavior matched the stealthy service-based loading technique highlighted in Sophos's analysis.
In mid-August 2023, Sophos X-Ops Incident Response responded to a cyber incident affecting a telecommunications company. After the customer was onboarded to Sophos MDR, analysts detected creation of a suspicious Cloudflared tunneling service and began investigating.
Sophos assessed that the malicious smpsvc.dll backdoor had likely been present in the telecommunications company's environment since at least June 2022. The DLL masqueraded as a legitimate SMP host service component and was configured to auto-start via the legitimate smphost service.
Sophos MDR Ops and SophosLabs researchers uncovered a backdoor they dubbed NotSoTinyTurla, assessed overlaps with Turla activity previously described by Cisco Talos, and identified follow-on actions including DCSync, Impacket discovery, and creation of the SRService service to deploy cloudflared for persistent access. Sophos said it disrupted the Cloudflare tunnel activity before further attacker actions occurred.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026
Researchers and incident responders linked multiple stealth backdoors to **Turla**, showing how the group maintains covert access across both Linux and Windows environments. Analysis of **Penquin**, a Linux backdoor tied to Turla, found that it does not contain a hardcoded command-and-control server; instead, it waits for a specially crafted network packet, extracts the C2 address from that trigger, and then initiates contact. By recreating the malware’s packet-validation logic and extending detection from UDP to TCP header fields, researchers scanned internet-facing systems and identified **86 IP addresses** believed to host Penquin, many on vulnerable VPS infrastructure in Europe, Russia, and the United States. The findings support assessments that compromised servers were used as relay or command infrastructure for broader Turla activity, including links to **TinyTurla** and operations targeting the Korean defense sector. Separate reporting on **TinyTurla** described a lightweight Windows backdoor used as a “second-chance” persistence mechanism when primary malware is removed. The malware masquerades as **Windows Time Service**, runs as `w64time.dll` under `svchost.exe`, and beacons over HTTPS at short intervals while supporting file transfer and remote process execution; observed victims included systems in the United States, Germany, and Afghanistan. Historical forensic work further tied Penquin to older **LOKI2**-derived Unix tooling recovered from the **Moonlight Maze** espionage campaign, reinforcing the long-running lineage between Moonlight Maze and modern Turla operations and showing the group’s continued reliance on covert relay infrastructure, trojanized system components, and low-noise persistence techniques.
Aug 16, 2026
Researchers reported that **Turla** updated its JavaScript-based espionage tooling across multiple intrusion paths, including a G20-themed spearphishing lure and long-running watering-hole operations. Proofpoint identified a new `.NET/MSIL` dropper that used a likely legitimate **G20 Digital Economy Taskforce** PDF invitation as a decoy, then wrote a Stage 1 JavaScript file to disk, created persistence with a scheduled task, fingerprinted the host, and loaded the **JS/KopiLuwak** backdoor in memory. The malware communicated over HTTP POST with compromised legitimate websites and supported reconnaissance, arbitrary code execution, and file transfer, indicating use in early-stage intelligence collection against likely targets such as diplomats, journalists, and policymakers. Separate reporting tied Turla to selective watering-hole compromises of legitimate, often embassy-related, websites that redirected chosen visitors to attacker infrastructure after browser and plugin fingerprinting. ESET also described an updated malicious Firefox extension linked to Turla that abused Instagram comments and a hidden `bit.ly` path for command-and-control discovery, while earlier research on the **Epic Turla** operation provides broader context for the group’s established cyber-espionage tradecraft. Together, the reports show Turla continuing to evolve stealthy first-stage access methods, blending decoy documents, compromised websites, social media, and legitimate web services to profile victims and deploy JavaScript backdoors.
Aug 14, 2026