Turla__2018__Eset-Turla-Outlook-Backdoor.pdf

This report delivers an in-depth analysis of the Turla Outlook backdoor, detailing how the Turla threat group uses a modular, email-driven malware that forwards outgoing emails, transmits commands and exfiltrated data via specially crafted PDF attachments, and persists through COM object hijacking across Microsoft Outlook and The Bat! clients, including its cryptographic and PDF-based command container architecture, indicators of compromise, and evidence of past and ongoing targeting of European governments and defense contractors.