Turla__2020__Turla_Venomous_Bear_updates_its_arsenal_NewPass_appears_on_the_APT_threat_scene_-_Telsy.pdf

Turla/Venomous Bear's update introduces a new malware implant 'NewPass' used in a June 2020 attack, featuring a dropper-loader-agent chain, in-memory JSON configuration, persistence via Windows services, and exfiltration to the C2 at newshealthsport.com, with a likely target in EU diplomacy/foreign affairs, demonstrating a sophisticated APT operation.