Trusted Design

Carbon Paper: Peering into Turlas second stage backdoor

概要

The Turla espionage group has been targeting various institutions for many years. Recently, we found several new versions of Carbon, a second stage backdoor in the Turla group arsenal. Last year, a technical analysis of this component was made by Swiss GovCERT.ch as part of their report detailing the attack that a defense firm owned by the Swiss government, RUAG, suffered in the past. This blog post highlights the technical innovations that we found in the latest versions of Carbon we have discovered.

Created: 2026-02-23

Indicators

類似Pulses

Analysis of Project Cobra (2015) (score: 0.54)
Satellite Turla: APT Command and Control in the Sky (score: 0.53)
Sphinx Moth: New IOC's on Wild Neutron/Morpho APT (score: 0.50)
Backdoor.Cadelspy and Backdoor.Remexi (score: 0.50)
New traces of Hacking Team in the wild (score: 0.49)

このPulseに関連する脅威アクター (事実ベース)

APT41

Score: 3.29

Matched TTPs:

T1069 - Permission Groups Discovery

MITREへのリンク →

Scattered Spider

Score: 6.91

Matched TTPs:

T1069 - Permission Groups Discovery
T1074 - Data Staged

MITREへのリンク →

TA505

Score: 3.29

Matched TTPs:

T1069 - Permission Groups Discovery

MITREへのリンク →

Volt Typhoon

Score: 6.91

Matched TTPs:

T1069 - Permission Groups Discovery
T1074 - Data Staged

MITREへのリンク →

APT3

Score: 3.29

Matched TTPs:

T1069 - Permission Groups Discovery

MITREへのリンク →

FIN13

Score: 3.29

Matched TTPs:

T1069 - Permission Groups Discovery

MITREへのリンク →

Wizard Spider

Score: 7.75

Matched TTPs:

T1074 - Data Staged
T1552.006 - Group Policy Preferences

MITREへのリンク →

INC Ransom

Score: 3.62

Matched TTPs:

T1074 - Data Staged

MITREへのリンク →

APT33

Score: 4.13

Matched TTPs:

T1552.006 - Group Policy Preferences

MITREへのリンク →

Mustang Panda

Score: 8.67

Matched TTPs:

T1678 - Delay Execution
T1027.007 - Dynamic API Resolution

MITREへのリンク →

APT28

Score: 9.08

Matched TTPs:

T1546.015 - Component Object Model Hijacking
T1137.002 - Office Test

MITREへのリンク →

Lazarus Group

Score: 6.66

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1566.003 - Spearphishing via Service

MITREへのリンク →

PLATINUM

Score: 4.54

Matched TTPs:

T1056.004 - Credential API Hooking

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.81

Matched TTPs:

T1137.002 - Office Test
T1546.015 - Component Object Model Hijacking

MITREへのリンク →

Mustang Panda

Score: 0.78

Matched TTPs:

T1678 - Delay Execution
T1027.007 - Dynamic API Resolution

MITREへのリンク →

Wizard Spider

Score: 0.68

Matched TTPs:

T1074 - Data Staged
T1552.006 - Group Policy Preferences

MITREへのリンク →

Volt Typhoon

Score: 0.64

Matched TTPs:

T1069 - Permission Groups Discovery
T1074 - Data Staged

MITREへのリンク →

Scattered Spider

Score: 0.62

Matched TTPs:

T1069 - Permission Groups Discovery
T1074 - Data Staged

MITREへのリンク →

Lazarus Group

Score: 0.61

Matched TTPs:

T1566.003 - Spearphishing via Service
T1027.007 - Dynamic API Resolution

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る