Turla__2016__Report_Ruag-Espionage-Case.pdf

GovCERT's RUAG Technical Report analyzes a long-running cyber espionage operation attributed to the Turla/Tavdig actor group, describing recon tools and stage-2 trojans, the use of Carbon-DLL and Tavdig, a hierarchical botnet, communication via named pipes and HTTP-based C2, extensive fingerprinting and information gathering, persistence and lateral movement within Active Directory, data exfiltration of approximately 23 GB, and comprehensive recommendations across system, AD, and network controls to detect and mitigate such attacks.