Introducing WhiteBear

The report provides an in-depth look at WhiteBear, a Turla-linked malware campaign, describing its elaborate binary loader, transport library, and C2 transport, its spearphishing delivery, targeted embassies and defense-related entities, and its use of code-signing certificates and complex persistence mechanisms; it also notes infrastructure overlap with other Turla operations and that WhiteBear activity appears to have diminished after June 2017.