Loading story…
Cisco Talos reported that the Russia-linked Turla espionage group deployed a new lightweight backdoor, TinyTurla-NG, against Polish NGOs, including an organization supporting Ukraine. The malware acted as a fallback persistence mechanism, using compromised WordPress sites for command-and-control and supporting command execution, file transfer, shell switching, timing changes, and self-deletion. Talos also observed TurlaPower-NG PowerShell scripts used to collect and exfiltrate files, including key material tied to password-manager database protection, indicating an effort to steal credentials and preserve access inside targeted networks.
Other reporting tied Turla to parallel intrusions using similar stealth and persistence tradecraft. CERT-UA linked UAC-0024 activity against Ukraine’s defense sector to Turla, citing use of CAPIBAR, KAZUAR, COM hijacking, phishing documents, and exfiltration via rclone, while Cyble described a suspected Turla campaign in the Philippines that used malicious .LNK files, PowerShell, and MSBuild to install a tiny backdoor through scheduled-task persistence and compromised web infrastructure. Together, the reports show Turla continuing to expand its malware toolkit and reuse covert delivery, persistence, and credential-theft techniques across espionage operations aligned with Russian intelligence objectives.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Cyble described a campaign using malicious .LNK files disguised as PDFs to launch PowerShell, decrypt MSBuild payloads, and install a lightweight backdoor with scheduled-task persistence every 20 minutes. The report assessed with medium confidence that the activity was linked to Turla based on code and behavioral similarities to TinyTurla and use of a compromised Philippine news domain for C2.
Cisco Talos disclosed a Turla espionage campaign targeting Polish NGOs and identified the new TinyTurla-NG backdoor and associated TurlaPower-NG PowerShell exfiltration scripts. Talos assessed TinyTurla-NG as a 'last chance' persistence mechanism and documented capabilities including command execution, file transfer, self-deletion, and likely COM hijacking-based persistence.
Talos reported the TinyTurla-NG campaign targeting Polish NGOs was still active as recently as January 27, 2024. The operation used compromised vulnerable WordPress sites as command-and-control infrastructure and included TurlaPower-NG scripts for file collection and exfiltration.
Cisco Talos said the earliest observed compromise in the TinyTurla-NG campaign occurred on December 18, 2023, targeting a Polish NGO that worked to improve democracy and support Ukraine. Talos linked the activity to Turla and identified TinyTurla-NG as a lightweight persistence backdoor.
CERT-UA reported that since 2022 it has tracked a targeted espionage cluster as UAC-0024, primarily targeting Ukraine’s defense forces. The activity used CAPIBAR malware, sometimes deployed via compromised Microsoft Exchange servers, and in some intrusions also delivered the KAZUAR backdoor.
A joint NCSC and NSA advisory described Turla acquiring and using Iranian-origin Neuron and Nautilus implants, scanning for Iranian ASPX backdoors, and leveraging Iranian command-and-control infrastructure to expand access to additional victims, especially in the Middle East. Investigators also found Turla tested the Iranian tools on victims it had already compromised with Snake and used stolen cryptographic material and controller access to operate them.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
cyble.com
Open sourceblog.talosintelligence.com
Open sourcencsc.gov.uk
Open sourcewelivesecurity.com
Open sourceweb-assets.esetstatic.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported that the Russia-linked **Turla** espionage group has been using a multi-component `.NET` backdoor called **STOCKSTAY** since at least December 2022 to target Ukrainian government and military organizations, as well as entities involved in Italian foreign policy. The malware supports command execution, file theft, registry changes, screen capture, and host reconnaissance, and uses separate modules for orchestration and WebSocket-based command-and-control tunneling. Researchers said STOCKSTAY shares architectural and code similarities with Turla’s **KAZUAR** toolkit, including the `K1MORPHER` obfuscation mechanism and environmental keying, indicating the tool is part of Turla’s broader intelligence-gathering arsenal. The campaign used multiple delivery methods, including malicious **RDP** files, **HTA** files, **MSI** installers, and exploitation of WinRAR path traversal flaw `CVE-2025-8088`, often paired with academic, diplomatic, or military-themed lures. Google also observed Turla relying on compromised Ukrainian infrastructure, GitHub repositories, and cloud hosting services such as **Render** and **Glitch** to stage payloads and run command-and-control infrastructure. The company assessed that STOCKSTAY remains under active development alongside KAZUAR and is used both for initial access and as a persistence or fallback capability during espionage operations.
Jul 12, 2026
Researchers and incident responders linked multiple stealth backdoors to **Turla**, showing how the group maintains covert access across both Linux and Windows environments. Analysis of **Penquin**, a Linux backdoor tied to Turla, found that it does not contain a hardcoded command-and-control server; instead, it waits for a specially crafted network packet, extracts the C2 address from that trigger, and then initiates contact. By recreating the malware’s packet-validation logic and extending detection from UDP to TCP header fields, researchers scanned internet-facing systems and identified **86 IP addresses** believed to host Penquin, many on vulnerable VPS infrastructure in Europe, Russia, and the United States. The findings support assessments that compromised servers were used as relay or command infrastructure for broader Turla activity, including links to **TinyTurla** and operations targeting the Korean defense sector. Separate reporting on **TinyTurla** described a lightweight Windows backdoor used as a “second-chance” persistence mechanism when primary malware is removed. The malware masquerades as **Windows Time Service**, runs as `w64time.dll` under `svchost.exe`, and beacons over HTTPS at short intervals while supporting file transfer and remote process execution; observed victims included systems in the United States, Germany, and Afghanistan. Historical forensic work further tied Penquin to older **LOKI2**-derived Unix tooling recovered from the **Moonlight Maze** espionage campaign, reinforcing the long-running lineage between Moonlight Maze and modern Turla operations and showing the group’s continued reliance on covert relay infrastructure, trojanized system components, and low-noise persistence techniques.
Aug 16, 2026
Researchers reported that **Turla** updated its JavaScript-based espionage tooling across multiple intrusion paths, including a G20-themed spearphishing lure and long-running watering-hole operations. Proofpoint identified a new `.NET/MSIL` dropper that used a likely legitimate **G20 Digital Economy Taskforce** PDF invitation as a decoy, then wrote a Stage 1 JavaScript file to disk, created persistence with a scheduled task, fingerprinted the host, and loaded the **JS/KopiLuwak** backdoor in memory. The malware communicated over HTTP POST with compromised legitimate websites and supported reconnaissance, arbitrary code execution, and file transfer, indicating use in early-stage intelligence collection against likely targets such as diplomats, journalists, and policymakers. Separate reporting tied Turla to selective watering-hole compromises of legitimate, often embassy-related, websites that redirected chosen visitors to attacker infrastructure after browser and plugin fingerprinting. ESET also described an updated malicious Firefox extension linked to Turla that abused Instagram comments and a hidden `bit.ly` path for command-and-control discovery, while earlier research on the **Epic Turla** operation provides broader context for the group’s established cyber-espionage tradecraft. Together, the reports show Turla continuing to evolve stealthy first-stage access methods, blending decoy documents, compromised websites, social media, and legitimate web services to profile victims and deploy JavaScript backdoors.
Aug 14, 2026