The C&C can send arbitrary commands to the infected system using Wscript.shell.run().
Turla is the name of a Russian cyber espionage APT group (also known as Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2007 targeting government organizations and private businesses.
The list of victims is long and includes also the Swiss defense firm RUAG and the US Central Command.
Back to the present, the APT group appears to be actively targeting G20 participants and those interested in its activities including politicians, member nations, and journalists.
“In this case, the dropper is being delivered with a benign and possibly stolen decoy document inviting recipients to a G20 task force meeting on the “Digital Economy”. The Digital Economy event is actually scheduled for October of this year in Hamburg, Germany. ” states Proofpoint. “The dropper first appeared in mid-July, suggesting that this APT activity is potentially ongoing, with Turla actively targeting G20 participants and/or those with interest in the G20, including member nations, journalists, and policymakers.”
Researchers at Proofpoint recently discovered the dropper on a public malware repository, hackers are delivering it to targets via spear phishing emails that use weaponized attachment titled “Save The Date” invitation to the October G20 taskforce meeting.
The invitation is an executable Program Information File (PIG) that appears as a PDF document, it includes a set of instructions for delivering KupiLuwak. When the victim double-clicks on the PDF icon, the PIF opens the decoy document normally while in the background it delivers the backdoor.
Once installed on a system, KupiLuwak allows the attackers to fully control it.
The experts believe the decoy document is a genuine invitation to the G20 task force meeting and was likely stolen.
“As far as we are aware, this document is not publicly available and so may indicate that an entity with access to the invitation was already compromised. Alternatively, the document may have been legitimately obtained from a recipient.” continues ProofPoint.
“Proofpoint researchers ascertain with medium confidence that the document is legitimate and not fabricated.”
The subject of the weaponized documents used by the hackers suggests the Turla APT is gathering information related to G20 event and its participants.
Anyway, we have to consider that the samples analyzed by Proofpoint were obtained from a public malware repository and were not observed in the wild, this means that it is quite impossible to estimate the full scope and impact of the attack.
The high profile of potentially targeted individuals associated with the G20 and early reconnaissance nature of the tools involved bear further watching. We have notified CERT-Bund of this activity.
We will continue to track the activities associated both with this actor and these new tools and update this blog as details emerge.
(Security Affairs – Turla APT, cyber espionage)