Workshop
Turla belongs among the so-called APT groups—persistent and often state-sponsored threats that attack deliberately and quietly. In the talk we saw a realistic simulation of its operation on Windows 10 and a comparison of how different types of protection respond. Key finding: this isn’t ransomware, but fast, stealthy data collection and exfiltration. The attack begins with targeted spear-phishing with an attachment (e.g., a VBS script or a document with a macro). Upon opening, the command prompt launches, a connection to a C2 (command-and-control) server is initialized, and commands arrive over encrypted HTTPS. This is followed by reconnaissance of the computer and network, saving outputs to text files, and packing them into an archive. The entire operation can take roughly eight minutes, with the goal being to obtain information and minimize traces, not encrypt data.Turla in practice: from lure to exit without a trace
