Trusted Design

Carbon Paper: Peering into Turlas second stage backdoor

概要

The Turla espionage group has been targeting various institutions for many years. Recently, we found several new versions of Carbon, a second stage backdoor in the Turla group arsenal. Last year, a technical analysis of this component was made by Swiss GovCERT.ch as part of their report detailing the attack that a defense firm owned by the Swiss government, RUAG, suffered in the past. This blog post highlights the technical innovations that we found in the latest versions of Carbon we have discovered.

Created: 2026-02-23

Indicators

類似Pulses

Analysis of Project Cobra (2015) (score: 0.54)
Satellite Turla: APT Command and Control in the Sky (score: 0.53)
Sphinx Moth: New IOC's on Wild Neutron/Morpho APT (score: 0.50)
Backdoor.Cadelspy and Backdoor.Remexi (score: 0.50)
New traces of Hacking Team in the wild (score: 0.49)

このPulseに関連する脅威アクター (事実ベース)

APT41

Score: 3.29

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Scattered Spider

Score: 6.91

Matched TTPs:

T1560.003 - Archive via Custom Method
T1083 - File and Directory Discovery

MITREへのリンク →

TA505

Score: 3.29

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Volt Typhoon

Score: 6.91

Matched TTPs:

T1560.003 - Archive via Custom Method
T1083 - File and Directory Discovery

MITREへのリンク →

APT3

Score: 3.29

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

FIN13

Score: 3.29

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Wizard Spider

Score: 7.75

Matched TTPs:

T1083 - File and Directory Discovery
T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

INC Ransom

Score: 3.62

Matched TTPs:

T1083 - File and Directory Discovery

MITREへのリンク →

APT33

Score: 4.13

Matched TTPs:

T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

Mustang Panda

Score: 8.67

Matched TTPs:

T1169 - Sudo
T1055.005 - Thread Local Storage

MITREへのリンク →

APT28

Score: 9.08

Matched TTPs:

T1548.004 - Elevated Execution with Prompt
T1588.003 - Code Signing Certificates

MITREへのリンク →

Lazarus Group

Score: 6.66

Matched TTPs:

T1055.005 - Thread Local Storage
T1547.008 - LSASS Driver

MITREへのリンク →

PLATINUM

Score: 4.54

Matched TTPs:

T1686 - Disable or Modify System Firewall

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.81

Matched TTPs:

T1588.003 - Code Signing Certificates
T1548.004 - Elevated Execution with Prompt

MITREへのリンク →

Mustang Panda

Score: 0.78

Matched TTPs:

T1055.005 - Thread Local Storage
T1169 - Sudo

MITREへのリンク →

Wizard Spider

Score: 0.68

Matched TTPs:

T1083 - File and Directory Discovery
T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

Volt Typhoon

Score: 0.64

Matched TTPs:

T1083 - File and Directory Discovery
T1560.003 - Archive via Custom Method

MITREへのリンク →

Scattered Spider

Score: 0.62

Matched TTPs:

T1083 - File and Directory Discovery
T1560.003 - Archive via Custom Method

MITREへのリンク →

Lazarus Group

Score: 0.61

Matched TTPs:

T1055.005 - Thread Local Storage
T1547.008 - LSASS Driver

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る