ESET BackdoorDiplomacy Jun 2021

Turian can insert pseudo-random characters into its network encryption setup.

Turian can retrieve the internal IP address of a compromised host.

Turian can use VMProtect for obfuscation.

BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.

Turian can retrieve usernames.

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.

Turian can disguise as a legitimate service to blend into normal operations.

BackdoorDiplomacy has dropped implants in folders named for legitimate software.

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.

Turian can create a remote shell and execute commands using cmd.

Turian has the ability to use /bin/sh to execute commands.

Turian has the ability to use Python to spawn a Unix shell.

Turian has the ability to use HTTP for its C2.

Turian can store copied files in a specific directory prior to exfiltration.

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.

Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.

Turian can search for specific files and list directories.

BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.

BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.

Turian can download additional files and tools from its C2.

Turian has the ability to take screenshots.

Turian can scan for removable media to collect data.

BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.

Turian can establish persistence by adding Registry Run keys.

Turian can use WinRAR to create a password-protected archive for files of interest.

BackdoorDiplomacy has executed DLL search order hijacking.

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.