MITRE ATT&CKsoftware (malware)

S0647 Turian

Published 2021-09-21 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows, Linux
Version
1.0
Created
2021-09-21

Description

Turian is a backdoor that has been used by BackdoorDiplomacy to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, Turian is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.

Related

Uses · MITRE ATT&CK (18)

  • T1001.001 Junk Data sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1059.006 Python sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1113 Screen Capture technique
  • T1120 Peripheral Device Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • G0135 BackdoorDiplomacy group

References