In reading recently about the advanced Turla spyware, I'm concerned about how it can go dormant when its controllers...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
sense a possible detection effort. How do attackers do this, and what's the best way to work protect against undetectable malware?
As computing and computer security advance, so do attackers. It shouldn't be a new concern that malicious attackers are adopting professional software development techniques. In fact, it would be more concerning if attackers weren't adopting these techniques, as that would mean they were so far ahead of the defenders that their attacks were undetectable.
The Turla APT campaign has incorporated many cutting-edge techniques used by advanced malware and demonstrates professional disciplined software development practices. The developers appear to have put significant efforts into planning the long-term development and operation of the malware, as well as its recently discovered cousin Epic. It has a modular framework design where the different components of the attack are automated. When a new attack technique is found, the development team can easily incorporate the new functionality into the attack plan and have the malware check into the command-and-control system to get an update.
According to an unnamed source in a Reuter's article, the Turla development team used a technique that is often leveraged by manual attackers. Once a manual attacker sees that one part of the attack is detected, he or she knows the other components of the attack are at a heightened risk of being detected and will change tactics, suspend the attacks, or accelerate the attack to gain access or steal the targeted sensitive data. In Turla, much like other malware, attackers will also remove logs from the local system so they can't be used to identify attacker activities.
The Turla spyware is designed to pause operations if a detection effort is sensed, so an update can be released to reduce the chances of the attack being detected. Turla lowers its odds of getting caught by monitoring the command-and-control infrastructure and, if a central node is detected as going offline, forces the malware to go dormant until further notice.
Enterprises can combat Turla by using an antimalware network appliance, a domain name system malware analysis tool, a network anomaly detection tool, or advanced endpoint security tools.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your questions now via email! (All questions are anonymous.)
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
The CryptXXX ransomware has been spreading through compromised legitimate websites that redirect to malicious sites. Expert Nick Lewis explains how ...continue reading
Attackers can use the SandJacking attack to access sandboxed data on iOS devices. Expert Nick Lewis explains how to protect your enterprise from this...continue reading
Malicious Windows BITS tasks set up by attackers can reinfect systems even after the malware has been removed. Expert Nick Lewis explains how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.