Turla__2018__Turla_APT.pdf

Proofpoint analyzes Turla APT activity using KopiLuwak, a new .NET/MSIL and JavaScript-based backdoor delivered with a G20-related decoy document; the dropper writes stage components, installs a JS decryptor, and loads the KopiLuwak backdoor in memory, with persistence, system fingerprinting, and RC4-encrypted C2 communications, suggesting a sophisticated, reconnaissance-focused campaign that remains unobserved in the wild so far.