Waterbug

Waterbug, also known as Turla, Venomous Bear, and several other names, is a cyberespionage group closely affiliated with the FSB Russian intelligence agency. The group has been active since at least 2004, targeting a variety of sectors including government entities, intelligence agencies, military, educational, research, and pharmaceutical industries across the globe. They are particularly infamous for their top-class rootkits such as Snake, WhiteBear, Uroburos, Group 88, and Waterbug. Their operations are extensive, reaching diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. In one of their notable attacks, Waterbug exploited a zero-day vulnerability in the Windows Kernel NDProxy.sys local privilege escalation (CVE-2013-5065). The group utilized variants of Trojan.Turla and Trojan.Wipbot, delivered through specially crafted emails with malicious attachments and a set of compromised websites. Furthermore, they used an older version of PowerShell, likely to avoid logging. Interestingly, while some actions suggested an attempt at a false flag operation, the group also used its own infrastructure for communication within the victim's network, which could be traced back to them. A recent development highlighted by a Cisco Talos blog post reveals that Waterbug has evolved its tools. The backdoor used in their recent attacks, dubbed "TinyTurla-NG," has functionalities very similar to the APT's known custom malware, TinyTurla. The FBI has tied this malware to a unit of Russia's Federal Security Service, further solidifying Waterbug's connection to the Russian intelligence agency. Despite their sophisticated attempts to mask their activities, Waterbug's operations continue to be traced back to them, underscoring the persistent threat they pose.