Penquin’s Moonlit Maze
by Costin Raiu, Daniel Moore, Juan Andres Guerrero-Saade, and Thomas Rid
2017-04-03
https://securelist.com/penquins-moonlit-maze/77883/ https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180251/Penquins_Moonlit_Maze_PDF_eng.pdf https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180254/Penquins_Moonlit_Maze_AppendixB.pdf https://youtu.be/9RorL9y70GU
I read this article due to the connection with LOKI2, one of the more interesting bits of malware that I have observed that works on Linux systems.
This article provides compelling links to the historic Moonlight Maze espionage campaign and the modern day Turla group.
A variant of LOKI2 was discovered and named “Penguin Turla”. Penguin Turla was originally misattributed as a cd00r variant.
Links
- https://www.melani.admin.ch/melani/en/home/dokumentation/reports/technical-reports/technical-report_apt_case_ruag.html
- https://securelist.com/the-epic-turla-operation/65545/
- https://securelist.com/kopiluwak-a-new-javascript-payload-from-turla/77429/
- https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/
- Wave Your False Flags https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf
- https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf
- https://web.archive.org/web/20170401225346/http:/www.zdnet.com/article/pentagon-and-hackers-in-cyberwar-5000101740/
- https://securelist.com/the-penquin-turla-2/67962/
- TurlaSat: The Fault in our Stars https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/Baumgartner-VB2015.pdf
- http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html
- https://blog.gdatasoftware.com/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified