Researchers uncover maze of hidden backdoors in European embassy and ministry systems

ESET's findings reveal the inner, technical workings of a complex cyber-espionage operation that is ongoing and spans more than a year.

A series of covert backdoor implants were secretly installed over the last year on dozens of computers used by embassies and foreign ministries across Southeast Europe and former Soviet states, according to new research published by cybersecurity firm ESET.

The malicious software was sent to victims through targeted phishing emails and allowed for a skilled group of hackers to remotely spy on foreign government officials and collect intelligence.

Some cybersecurity firms believe the hacking group exposed by ESET, known as Turla, is connected to Russian intelligence services.  The backdoor used by Turla has been codenamed Gazer.

ESET describes Gazer as a stealthy and complex hacking tool that is difficult to detect. The implant receives encrypted code from an external server, which can execute commands either directly through the infected machine or via another computer on a shared network. In addition, ESET found evidence that Turla leverages a virtual file system in the Windows registry to evade antivirus defenses after they’ve deployed Gazer.

Jean Ian Boutin, a senior malware researcher with ESET, said that while the number of infected computers isn’t believed to be very large, the operation appears to be focused on “targeted attacks” against “high value targets.”

“What we see is only a subset of attacks going on,” said Boutin. “We are still seeing new samples, we received new versions just a couple of weeks ago.”

A backdoor implant is typically one part of a hacker’s toolkit, used to upload other malicious files and maintain access on a system. The program is only installed after a computer has already been compromised, leading to additional capabilities and in some cases, wider access to other systems.

“Once [a backdoor] is on a system, it will reach out to its command and control server and can execute all kinds of attacks,” said Boutin. “It can execute new binaries so it can be used to install additional malware or additional tools to do lateral movement, it can also be used to fetch information from [other] systems … It really gives you total access to the system.”

Turla is known for spying on political and civil society organizations. The group is commonly referred to as an APT, or advanced persistent threat.

A variety of different governmental organizations based in the Balkan Peninsula have already been affected.

“Usually what [Turla] will do is send spear phishing emails and then install a first stage backdoor which is usually something a bit simpler so the functionalities aren’t that advanced. They’re using this to do some recon on the victim. If it’s interesting, they’ll push out a second stage backdoor and so Gazer is the second stage backdoor,” explained Boutin. “It’s meant to be more stealthy and is meant to be more persistent on the system.”

Turla, Boutin told CyberScoop, went to great lengths to keep Gazer from being discovered. A tool of this quality is typically expensive and difficult to engineer, experts say.

“We saw them really trying to change any type of data or strings — the binaries — so we lose track of them, we see they fight back to modify the backdoors so it’s harder to stop and harder to find. In terms of complexity of tools used by Turla, it’s quite high,” said Boutin.

He added, “I would rank the Turla tools very high in terms of complexity compared to other APTs but of course some other groups use these techniques as well.”

Patrick Howell O’Neill contributed to this report 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure