Turla Cyber Campaign Targeting Pakistan’s Critical Infrastructure

Category	Details
Threat Actors	Turla (Secret Blizzard, overlaps with Turla), leveraging Storm-0156 infrastructure.
Campaign Overview	Targeting Pakistan’s critical infrastructure, including energy, telecommunications, and government networks, using phishing and malware.
Target Regions (Or Victims)	Pakistan, including Afghan government and Indian Army infrastructure.
Methodology	Exploitation of vulnerabilities (e.g., CVE-2022-38028), DLL hijacking, C2 server connections, and leveraging third-party infrastructure.
Product Targeted	Critical infrastructure systems in energy, telecom, and government sectors.
Malware Reference	Custom malware tailored for espionage, data exfiltration, and disruption.
Tools Used	Multi-layered encryption, periodic C2 server connections, SOCRadar’s Threat Hunting module for analysis (recommended).
Vulnerabilities Exploited	CVE-2022-38028 and techniques like DLL hijacking.
TTPs	Obfuscation via third-party infrastructure, phishing, drive-by compromise, masquerading, and command scripting interpreters.
Attribution	Turla/Secret Blizzard leveraging tools from Storm-0156 (a Pakistan-based group).
Recommendations	Use browser sandboxes, network monitoring, secure traffic policies, phishing education, and threat hunting tools for detection.
Source	SOCRadar

Read full article: https://socradar.io/turla-cyber-campaign-pakistans-critical-infrastructure/

The above summary has been generated by an AI language model