Loading story…
Turla conducted a spear-phishing campaign that used malicious Microsoft Word documents with macros to install KopiLuwak, a multi-stage JavaScript backdoor aimed at government and diplomatic targets in Europe. Researchers linked the activity to Turla based on targeting and tradecraft, noting that victims appeared to include foreign ministries and other government organizations, with evidence pointing especially to Greece and additional links to Romania and Qatar. Sinkhole data also indicated at least one likely victim in the Greek Parliament.
Once executed, KopiLuwak established persistence through a Windows Run registry key, profiled infected systems with extensive reconnaissance commands, encrypted harvested data in memory, and communicated with hard-coded command-and-control URLs hosted on compromised websites. The malware also supported arbitrary command execution through Wscript, allowing operators to use it both as an initial foothold and as a tool for victim profiling and follow-on operations.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
John Lambert of Microsoft tweeted about a malicious document that dropped a JavaScript backdoor, publicly surfacing the activity. The tweet referenced the same malware activity later analyzed as KopiLuwak.
As of January 2017, Kaspersky assessed that the malware had infected only a single-digit number of victim organizations. Sinkhole data and targeting indicators suggested a particular focus on Greece, with additional indications involving Romania and Qatar.
Kaspersky observed Turla using a new JavaScript payload later identified as KopiLuwak, delivered via a malicious Word document macro, since the end of November 2016. The targeting aligned with Turla's historical focus on foreign ministries and government organizations in Europe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Turla** updated its JavaScript-based espionage tooling across multiple intrusion paths, including a G20-themed spearphishing lure and long-running watering-hole operations. Proofpoint identified a new `.NET/MSIL` dropper that used a likely legitimate **G20 Digital Economy Taskforce** PDF invitation as a decoy, then wrote a Stage 1 JavaScript file to disk, created persistence with a scheduled task, fingerprinted the host, and loaded the **JS/KopiLuwak** backdoor in memory. The malware communicated over HTTP POST with compromised legitimate websites and supported reconnaissance, arbitrary code execution, and file transfer, indicating use in early-stage intelligence collection against likely targets such as diplomats, journalists, and policymakers. Separate reporting tied Turla to selective watering-hole compromises of legitimate, often embassy-related, websites that redirected chosen visitors to attacker infrastructure after browser and plugin fingerprinting. ESET also described an updated malicious Firefox extension linked to Turla that abused Instagram comments and a hidden `bit.ly` path for command-and-control discovery, while earlier research on the **Epic Turla** operation provides broader context for the group’s established cyber-espionage tradecraft. Together, the reports show Turla continuing to evolve stealthy first-stage access methods, blending decoy documents, compromised websites, social media, and legitimate web services to profile victims and deploy JavaScript backdoors.
Aug 14, 2026
Cisco Talos reported that the Russia-linked **Turla** espionage group deployed a new lightweight backdoor, **TinyTurla-NG**, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed **TurlaPower-NG** PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks. Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked **UAC-0024** activity against Ukraine’s defense sector to Turla, citing use of **CAPIBAR**, **KAZUAR**, COM hijacking, phishing documents, and exfiltration via `rclone`, while Cyble described a suspected Turla campaign in the Philippines that used malicious `.LNK` files, PowerShell, and **MSBuild** to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
Aug 15, 2026
ESET disclosed **Gazer**, a previously undocumented second-stage backdoor attributed to the **Turla** cyberespionage group, describing its use in targeted intrusions against governments, diplomats, embassies, consulates, and ministries. The victims were concentrated in Europe, with a particular focus on Southeastern Europe and countries of the former Soviet Union, and the malware had reportedly been active since at least 2016. The backdoor was built for long-term covert access, using code-string changes, randomized markers, and secure file wiping to reduce detection while stealing information over extended periods. According to ESET, Turla typically began operations with spearphishing that deployed a first-stage implant such as **Skipper**, then escalated to stealthier payloads including **Gazer**, **Carbon**, or **Kazuar**, while relaying command-and-control traffic through compromised legitimate websites.
Aug 14, 2026