Ttng

TinyTurla-NG (TTNG) is a potent malware identified by Cisco Talos in partnership with CERT.NGO. TTNG is part of the arsenal used by the Turla APT, a notorious group of Russian state-sponsored actors known for their cyber espionage activities. This malicious software is designed to infiltrate systems, often undetected, and execute harmful actions such as stealing personal information or disrupting operations. The TTNG backdoor is akin to Turla's implant TinyTurla, showing similarities in their operational patterns. The command and control (C2) scripts associated with TTNG play a crucial role in the malware's operation. These scripts are deployed on compromised WordPress servers and are intended to deliver executables and administrative commands to infected systems. If an "id" is provided in the HTTP request to the C2 server, this is treated as communication with an implant like TTNG or TurlaPower-NG. The "id" parameter is the same variable passed by the TTNG and TurlaPower-NG implants during communication with the C2, which then creates a logging directory on the C2 server. Post-compromise, TTNG operators issue three sets of modular PowerShell commands: reconnaissance commands used to enumerate files in a directory specified by the operator. The malware uses a privilege elevation tool to run these PowerShell scripts. Besides TurlaPower-NG, another implant was found on infected systems, suggesting the use of Chisel as another means of persistent access. The output of a command executed on an infected endpoint by the TTNG backdoor is obtained and recorded into a file on disk by the C2, illustrating the depth of control the malware has over compromised systems.