December 11, 2024 By Bill Toulas
Russian cyber-espionage group Turla, aka "Secret Blizzard," is utilizing other threat actors' infrastructure to target Ukrainian military devices connected via Starlink.
Microsoft and Lumen recently exposed how the nation-state actor, who is linked to Russia's Federal Security Service (FSB), is hijacking and using malware and servers of the Pakistani threat actor Storm-0156.
Microsoft released another report today focusing on separate Turla operations between March and April 2024, targeting devices in Ukraine used in military operations.
In the latest campaign, Turla utilized the infrastructure for the Amadey botnet and another Russian hacking group known as "Storm-1837." This infrastructure was used to deploy Turla's custom malware families, including Tavdig and KazuarV2, on Ukrainian systems.
