How BackdoorDiplomacy APT Group Uses Turian Backdoor To Carryout Cyber Espionage Campaign?

Cybersecurity researchers disclosed a new Turian Backdoor used to carry out a cyber espionage campaign by BackdoorDiplomacy APT Group on Thursday that has been behind a sequence of targeted attacks against telecommunication companies and diplomatic entities in the Middle East and Africa since 2017. The threat actor is known as “Backdoor Diplomacy” due to the use of Turian Backdoor and its priority for diplomatic targets.  

The Backdoor Diplomacy APT Group involves targeting the vulnerabilities in internet-exposed devices, such as web servers, for cybercriminal activities. These include lateral movement across a network to deploy the custom implant known as Turian. It is capable of exfiltrating sensitive information stored in removable media.

What Is Cyber Espionage Campaign?

The Cyber Espionage Campaign targets the victim with the help of a previously undocumented kind of malware that brings a secret backdoor onto the compromised Windows systems. Cyber spying or cyber espionage is a kind of cyber attack in which an unauthorized user tries to access classified or sensitive data and intellectual property for competitive advantage, economic gain, or political reasons.

 In some scenarios, a data breach is intended to cause reputational damage to the target by exposing sensitive data or questionable business practices. The most common victims of cyber espionage campaigns include government agencies, large corporations, academic institutions, or organizations that possess technical data and valuable IP to create a competitive advantage over other organizations.

What Is A Backdoor Malware?

A backdoor attack is a kind of malware that gives hackers unauthorized access to a website. As a result, hackers can remotely access an application, such as file servers and databases. The backdoor provides a safe path for perpetrators the ability to issue system commands and update malware.

Hackers install malware through unsecured entry points, such as input fields or outdated plug-ins. Once they enter a website or an application, they can access all your company’s data, including users’ personally identifiable information.

Web Server backdoor can be used for several malicious activities, including

About BackdoorDiplomacy APT Group

The Backdoor diplomacy APT Group is seen targeting the regional diplomatic organizations in Asia and Africa, and rarely telecommunication companies. Researchers observed that the campaign was conducted on public-facing servers within the target organizations spying on network traffic and sending commands to compromised hosts. The Backdoor diplomacy APT group uses the Moriya rootkit to deploy the passive backdoor that allows cybercriminals to analyze incoming traffic to the infected system, Kaspersky says.

The APT group is linked with several other Asian groups. Most common among them is the link between the Quarian backdoor and the Turian backdoor. It is also connected with a group referred to as “CloudComputating” analyzed by Sophos.

About Turian Backdoor

Kaspersky reported that both Quarian and Turian backdoors had targeted the same set of victims. On top of that, there are certain similarities seen between the two malware. This concludes cybersecurity researchers that Turin is derived from the Quarian.

Mutex used in Turin to verify that only one instance is running is named differently than the Mutex seen in Quarian. Here you see a few Mutex captured during the analysis of Turin.

Here are some of the capabilities discovered: