Turla__2016__waterbug-attack-group.pdf

This Symantec report analyzes Waterbug, a state-sponsored cyber-espionage group that uses Trojan.Wipbot and Trojan.Turla to compromise government-related targets worldwide through targeted email and watering-hole campaigns, including zero-day exploits and a large Venom distribution network. It details multiple malware variants, links between Wipbot and Turla, complex command-and-control infrastructure, exposed exploits, Trojanized software distribution, and extensive indicators of compromise across infected hosts and websites.