Turla__2020__Tracking_Turla_New_backdoor_delivered_via_Armenian_watering_holes_WeLiveSecurity.pdf

ESET researchers report a Turla watering hole campaign targeting Armenian government and related sites, injecting obfuscated JavaScript to load fingerprinting data and delivering two new backdoors, NetFlash and PyFlash, through a fake Adobe Flash update; NetFlash uses a .NET downloader with scheduled tasks and PyFlash is a Python-based backdoor that communicates over HTTP, accompanied by IoCs and MITRE techniques.