Moonlight Maze

Moonlight Maze is a notorious malware that was part of an extensive espionage campaign during the 1990s. The malicious software compromised the networks of several key institutions, including the Department of Defense, NASA, and the Department of Energy, along with defense contractors and other parties. This malware was characterized by its stealthy approach to infiltrating systems, rarely drawing attention to itself while focusing on classic targets of espionage such as government, military, and the defense sector. The group behind Moonlight Maze also carried out other significant attacks, such as the Agent.BTZ campaign in the early 2000s. This involved a computer worm that used USB flash drives to infect both classified and unclassified networks at U.S. Central Command. Despite these high-profile operations, most of the group's activities go unnoticed due to their reliably quiet assault on targets. In recent years, the group, known as Turla, has continued its cyber espionage activities. For instance, they were observed using command-and-control servers from a decade-old malware called Andromeda to target and spy on Ukrainian systems. The work on Moonlight Maze has gained recognition and is now featured in the International Spy Museum's permanent exhibit in Washington, DC. Despite occasional exposure of major incidents like the Agent.BTZ incident and Moonlight Maze activity, the breadth of Turla's activities often remains undetected.