Procedure examples

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.

Turla has gathered credentials from the Windows Credential Manager tool.

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.

Turla has placed LunarWeb install files into directories that are excluded from scanning.

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.

Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.

Turla has used the VPS infrastructure of compromised Iranian threat actors.

Turla has used compromised servers as infrastructure.

Turla has frequently used compromised WordPress sites for C2 infrastructure.

Turla has developed its own unique malware for use in operations.

Turla has used malware obtained after compromising other threat actors, such as OilRig.

Turla has obtained and customized publicly-available tools like Mimikatz.

Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.