Russia’s Turla group goes trolling with code labeled “TrumpTower”

Kaspersky found that the group also referred to 'Rocket Man,' apparently a reference to Kim Jong Un.

It’s a common practice: Researchers digging through malware find legitimate clues that point to its authors or data that are false flags meant to throw researchers off the right path.

In the case of the Turla hacking group, which is reportedly tied to Russia’s FSB intelligence service, it is unclear why the group decided to name one of its code strings “TrumpTower” or another “RocketMan!” – presumably a reference to U.S. President Donald Trump’s nickname for North Korean dictator Kim Jong Un.

Regardless of whether or not Turla was trolling, it’s clear to researchers from cybersecurity company Kaspersky that the new code was built for an ongoing hacking campaign aimed at a narrow set of unnamed government organizations. To deliver the malicious code to its targets, Turla used legitimate software downloaders, such as tools to evade internet censorship, that were infected with a “dropper” to install the malware.

While not saying where the targeting occurred, Kaspersky researchers on Monday published a set of Turla attack data meant to warn the cybersecurity community about the activity. That included a malware module that was used to deliver a JavaScript trojan long associated with Turla. The hackers are also using several compromised WordPress websites to communicate with their malware, Kaspersky researchers said.

Despite the recognizable names of their code strings, Turla has taken steps to keep its latest activity from being detected, the researchers said. For example, the attackers used a Windows system registry to store encrypted data that the malware could use at a later time.

Turla has been active in the last year and half, targeting at least 13 organizations across 10 countries, Symantec, another cybersecurity, said last month.

“[Turla] still follows a high-profile political agenda and now developers have broadened their arsenal of tools and spreading techniques,” a Kaspersky researcher told CyberScoop.

“The campaign was targeted, so there are only a few targets,” the researcher added, declining to disclose details of where the targeting occurred.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure