• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat ALert – Continued Activity of Kimsuky Group – IOC’s
October 21, 2019
Rewterz Threat Alert – Fake WordPress Plugin Embedded with Cryptocurrency Miner
October 21, 2019

Rewterz Threat Alert – Turla group Exploits Their CounterParts

October 21, 2019

Severity

High

Analysis Summary

The Turla group, also known as Waterbug or VENOMOUS BEAR, is widely reported to be associated with Russian actors. Turla uses a range of tools and techniques to target government, military, technology, energy and commercial organisations for the purposes of intelligence collection. Turla’s use of Neuron and Nautilus implants and an ASPX-based backdoor alongside the Snake rootkit.

After acquiring the tools – and the data needed to use them operationally – Turla first tested them against victims they had already compromised using their Snake toolkit, and then deployed the Iranian tools directly to additional victims. Turla sought to further their access into victims of interest by scanning for the presence of Iranian backdoors and attempting to use them to gain a foothold. The focus of this activity from Turla was largely in the Middle East, where the targeting interests of both Advanced Persistent Threats (APTs) overlap.

Impact

  • Remote code execution
  • Exfiltrate sensitive documents

Indicators of Compromise

MD5

  • d891c9374ccb2a4cae2274170e8644d8
  • 60bcc6bc746078d81a9cd15cd4f199bb

SH256

  • 83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015
  • 51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927

SHA1

  • c9fc7ce10aba20894ef914d2073021a48995db17
  • 2fb145c64263006a95a0771b57e967977f63954d

Remediation

Block all threat indicators at your respective controls.

  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.