ESET researchers analyze new PowerShell-based tools used by Turla, an infamous APT group, that improve persistence and stealth. Turla, also known as Snake, recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. Thanks to these PowerShell-based tools, Turla can bypass those detection techniques that are triggered when a malicious executable is dropped on a disk.<\/p>\n
Turla is an infamous espionage group recognized for its complex malware. It is believed to have been operating since at least 2008, when it successfully breached the US military. It has also been involved in major attacks against many government entities in Europe and the Middle East \u2013 among them the German Foreign Office and the French military.<\/p>\n
Recently, ESET researchers detected several attacks against diplomatic entities in Eastern Europe using PowerShell scripts. \u201cIt is likely the same scripts are used globally against other traditional Turla targets,\u201d says Matthieu Faou, ESET researcher who conducted the investigation.<\/p>\n
ESET researchers have published a blogpost with the results of their analysis of Turla\u2019s PowerShell scripts to help defenders counter them. \u201cAlong with Turla\u2019s new PowerShell loader, we\u2019ve discovered and analyzed several interesting payloads, including an RPC-based backdoor and a PowerShell backdoor leveraging Microsoft\u2019s cloud storage service, OneDrive, as its Command and Control server,\u201d says Faou.<\/p>\n
The PowerShell loaders, detected by ESET under the umbrella name PowerShell\/Turla, differ from simple droppers in their ability to persist on the system as they regularly load into memory only the embedded executables. In some samples, Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface (AMSI). This technique, which was first disclosed at the Black Hat Asia 2018 conference, leads to the antimalware product being unable to receive data from the AMSI interface for scanning.<\/p>\n
\u201cHowever, these techniques do not prevent the detection of the actual malicious payloads in memory.\u201d explains Matthieu Faou.<\/p>\n
Among the payloads recently used by Turla, two stand out. One is a whole set of backdoors relying on the RPC protocol. These backdoors are used to perform lateral movement and take control of other machines in the local network without relying on an external C&C server.\u00a0 Also, of interest is PowerStallion, a lightweight PowerShell backdoor using the above-mentioned Microsoft cloud storage service, OneDrive, as a Command & Control server.<\/p>\n
\u201cWe believe this backdoor is a recovery access tool in case the main Turla backdoors are removed and operators can no longer access the compromised computers,\u201d comments Matthieu Faou.<\/p>\n
ESET researchers are committed to closely following the Turla APT group and other key threat actors, and to monitoring their techniques, tactics and procedures to help defenders protect the networks they are responsible for.<\/p>\n
More details can be read in the blogpost published on WeLiveSecurity.com<\/p>\n","protected":false},"excerpt":{"rendered":"
ESET researchers analyze new PowerShell-based tools used by Turla, an infamous APT group, that improve persistence and stealth. Turla, also known as Snake, recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. Thanks to these PowerShell-based tools, Turla can bypass those detection techniques that are triggered when […]<\/p>\n","protected":false},"author":2,"featured_media":1618,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[217],"class_list":["post-11038","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-eset","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n