The 'Penquin' Turla

From Botnets.fr
Jump to navigation Jump to search

(Publication) Google search: [1]

The 'Penquin' Turla
Botnet Turla
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date 2014 / 2014-12-08
Editor/Conference Kaspersky Securelist
Link http://securelist.com/blog/research/67962/the-penquin-turla-2/ (Archive copy)
Author Kurt Baumgartner, Costin Raiu
Type Blogpost

Abstract

So far, every single Turla sample we've encountered was designed for the Microsoft Windows family, 32 and 64 bit operating systems. The newly discovered Turla sample is unusual in the fact that it's the first Turla sample targeting the Linux operating system that we have discovered.

Penquin_1

This newly found Turla component supports Linux for broader system support at victim sites. The attack tool takes us further into the set alongside the Snake rootkit and components first associated with this actor a couple years ago. We suspect that this component was running for years at a victim site, but do not have concrete data to support that statement just yet.

Bibtex

 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2014BFR332,
   editor = {Kaspersky Securelist},
   author = {Kurt Baumgartner, Costin Raiu},
   title = {The 'Penquin' Turla},
   date = {08},
   month = Dec,
   year = {2014},
   howpublished = {\url{http://securelist.com/blog/research/67962/the-penquin-turla-2/}},
 }