Loading story…
ESET disclosed Gazer, a previously undocumented second-stage backdoor attributed to the Turla cyberespionage group, describing its use in targeted intrusions against governments, diplomats, embassies, consulates, and ministries. The victims were concentrated in Europe, with a particular focus on Southeastern Europe and countries of the former Soviet Union, and the malware had reportedly been active since at least 2016.
The backdoor was built for long-term covert access, using code-string changes, randomized markers, and secure file wiping to reduce detection while stealing information over extended periods. According to ESET, Turla typically began operations with spearphishing that deployed a first-stage implant such as Skipper, then escalated to stealthier payloads including Gazer, Carbon, or Kazuar, while relaying command-and-control traffic through compromised legitimate websites.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
ESET published research describing Gazer as an advanced second-stage backdoor used for long-term espionage and stated it was the first to document the malware publicly. The research attributed the campaigns to the Turla group based on similarities with prior operations and described spearphishing, first-stage backdoors such as Skipper, and compromised websites used as command-and-control proxies.
ESET reported evidence that the previously undocumented Gazer backdoor had been actively used since at least 2016 in targeted attacks against governments, diplomats, embassies, consulates, and ministries. The victims identified were concentrated in Europe, especially Southeastern Europe and former Soviet Union countries.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **Turla** espionage group deployed a unique backdoor that abused Microsoft Outlook to conduct covert operations against targets in Europe. The malware used Outlook as a communications channel, allowing operators to hide command-and-control activity inside normal email traffic and blend malicious actions with legitimate enterprise workflows. The campaign was aimed at **European institutions**, underscoring Turla’s continued focus on long-term intelligence collection against government and diplomatic targets. By leveraging a trusted application already embedded in many organizations, the attackers reduced the likelihood of detection while maintaining persistent access for surveillance and data theft.
Jul 12, 2026
Researchers reported that **Turla** updated its JavaScript-based espionage tooling across multiple intrusion paths, including a G20-themed spearphishing lure and long-running watering-hole operations. Proofpoint identified a new `.NET/MSIL` dropper that used a likely legitimate **G20 Digital Economy Taskforce** PDF invitation as a decoy, then wrote a Stage 1 JavaScript file to disk, created persistence with a scheduled task, fingerprinted the host, and loaded the **JS/KopiLuwak** backdoor in memory. The malware communicated over HTTP POST with compromised legitimate websites and supported reconnaissance, arbitrary code execution, and file transfer, indicating use in early-stage intelligence collection against likely targets such as diplomats, journalists, and policymakers. Separate reporting tied Turla to selective watering-hole compromises of legitimate, often embassy-related, websites that redirected chosen visitors to attacker infrastructure after browser and plugin fingerprinting. ESET also described an updated malicious Firefox extension linked to Turla that abused Instagram comments and a hidden `bit.ly` path for command-and-control discovery, while earlier research on the **Epic Turla** operation provides broader context for the group’s established cyber-espionage tradecraft. Together, the reports show Turla continuing to evolve stealthy first-stage access methods, blending decoy documents, compromised websites, social media, and legitimate web services to profile victims and deploy JavaScript backdoors.
Aug 14, 2026
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026