TinyTurla-NG Backdoor Has Big Capabilities

New details of the recently discovered TinyTurla-NG backdoor show that the implant uses the Chisel open-source attack framework as part of its post-compromise actions and uses two separate batch files to create a service for persistence on the compromised machine.

The TinyTurla-NG backdoor is a relatively new addition to the toolbox of the Turla APT group, a team that has been attributed to the Russian FSB and has been active for many years. Researchers from Cisco’s Talos Intelligence Team …

actions addition apt attack attack framework backdoor batch big capabilities chisel compromise compromised files framework implant machine persistence service tinyturla-ng toolbox turla