Turla Cyber Campaign Targeting Pakistan’s Critical Infrastructure

Among the most notorious cyber threat actors, the Turla group has garnered attention for its sophisticated and complex cyber attacks. Considered a state-sponsored actor, Turla has targeted governments, military institutions, and critical infrastructure across various regions. In its latest campaign, the group has focused its attention on Pakistan’s critical infrastructure.

“Turla Cyber Campaign Targeting Pakistan’s Critical Infrastructure” illustrated by DALL-E

These attacks pose significant threats not only to Pakistan but also to regional security and the global cyber threat landscape.

Campaign Details

Turla’s new campaign targeting Pakistan focuses on energy, telecommunications, and government networks. The group has employed methods like phishing and malware deployment to gain access to its targets.

By exploiting vulnerabilities such as CVE-2022-38028, Turla has demonstrated advanced capabilities.

Techniques and Tools Used

Turla employs sophisticated techniques to maintain persistence and avoid detection within targeted systems. Key strategies include DLL hijacking, which allows them to remain undetected, and multi-layered encryption for secure communications. They frequently use periodic connections to C2 servers (Command and Control) and integrate malware into system startup points. The malware used in this campaign is tailored to exfiltrate sensitive data and disrupt target systems.

Espionage Tactics and Strategic Infrastructure Use

In late 2024, Microsoft reported that a threat group they track as Secret Blizzard, which overlaps with Turla, had compromised the infrastructure of Storm-0156, a Pakistan-based hacker group. By using Storm-0156’s backdoors and tools, Secret Blizzard (Turla) could target entities like the Afghan government and the Indian Army. This method of leveraging third-party infrastructure allowed Turla to obfuscate its operations, complicating attribution efforts, and enhance its espionage capabilities.

This incident highlights the increasing complexity of cyber threats, where adversaries exploit each other’s infrastructure to achieve strategic objectives. It underscores the importance of robust cybersecurity measures and vigilant monitoring to detect and mitigate such sophisticated attacks.

For organizations aiming to defend against advanced threats, SOCRadar’s Threat Hunting module offers crucial insights. This module enables in-depth analysis of adversarial tactics and techniques, helping organizations detect potential compromises early and respond effectively to sophisticated cyber espionage campaigns like this one.

Turla Cyber Campaign Targeting Pakistan’s Critical Infrastructure (SOCRadar platform, Campaigns page)

To gain deeper insights into the tactics and techniques employed by advanced threat actors like Turla, explore SOCRadar LABS’ Campaigns page. Here, you can find detailed reports on various cyber espionage operations, track ongoing trends, and access actionable intelligence to enhance your organization’s defense strategies.

Analysis of Indicators of Compromise (IOCs)

The campaign’s Indicators of Compromise (IOCs) include various IP addresses, domain names, and malware components. Notable IOCs include:

IP Addresses:

• 130.185.119[.]198
• 94.177.198[.]94
• 162.213.195[.]129

Domains:

• connectotels[.]net
• hostelhotels[.]net
• pentestlab[.]blog

These IOCs indicate the use of multiple Command and Control (C2) servers to facilitate communication between malware and the attackers. This infrastructure enables the attackers to maintain the campaign’s longevity.

Mitigation and Remediation

The tables below outline the key techniques used by threat actors and provide recommended mitigation and remediation actions to protect your systems and data against such techniques.

SOCRadar’s Cyber Threat Intelligence platform is critical in mitigating complex cyber campaigns. Its advanced modules provide proactive tracking of Indicators of Compromise (IOCs), in-depth threat actor analysis, and targeted threat reporting.

Notably, the Advanced Dark Web Monitoring and Threat Hunting modules are highly effective in identifying and responding to emerging threats. For more detailed insights and other cybersecurity strategies, explore our platform.