Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments

This threat intelligence report details Waterbug (Turla) espionage campaigns against governments and international organizations across multiple regions, describing three waves of activity with evolving toolsets, including Neptun, Meterpreter variants, and custom RPC backdoors, and noting an incident where Waterbug hijacked Crambus infrastructure to deliver malware, alongside extensive use of living-off-the-land techniques, credential theft, and indicators of compromise.