Trusted Design

KopiLuwak: A New JavaScript Payload from Turla

概要

On 28 January 2017, John Lambert of Microsoft (@JohnLaTwC) tweeted about a malicious document that dropped a “very interesting .JS backdoor“. Since the end of November 2016, Kaspersky Lab has observed Turla using this new JavaScript payload and specific macro variant. This is a technique we’ve observed before with Turla’s ICEDCOFFEE payloads, detailed in a private report from June 2016 (available to customers of Kaspersky APT Intelligence Services). While the delivery method is somewhat similar to ICEDCOFFEE, the JavaScript differs greatly and appears to have been created mainly to avoid detection.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Affiliate’s Malspam Operation: Kovter and Miuref/Boaxxe (score: 0.59)
• Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox (score: 0.59)
• IRS Refund-themed Spam Campaign Delivers Kovter and CoreBOT (score: 0.58)
• FIREEYE: Office Encapsulated PostScript & Priv Escalation 0days (score: 0.58)
• Kavala malware on Metadefender.com (score: 0.57)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る