Turla JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|Based on comparison of

Gazer versions,

Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.(Citation: ESET Gazer Aug 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Turla surveys a system upon check-in to discover operating system configuration details using the

Turla may attempt to connect to systems within a victim's network using

Turla surveys a system upon check-in to discover the system time by using the

Turla surveys a system upon check-in to discover remote systems on a local network using the

Turla has also used

Turla surveys a system upon check-in to discover active local network connections using the

Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the

Turla surveys a system upon check-in to discover information in the Windows Registry with the

Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also searched for files matching the

Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the