Yahoo Mail Archiver: A Sophisticated Cyber-Espionage Tool

Turla, also known as Snake or Uroburos, is one of the most sophisticated ongoing cyber-espionage campaigns. The group has developed a backdoor called Epic, which is used as a primary stage in their operations. In this article, we will delve into the details of Yahoo Mail Archiver and how it is used by Turla to compromise systems.

The attackers behind Turla are highly skilled and use a variety of vectors to deliver the Epic malware. These include watering hole attacks that rely on social engineering to trick users into running fake 'Flash Player' malware installers, as well as attacks using Java exploits (CVE-2012-1723), Adobe Flash exploits (unknown) or Internet Explorer 6, 7, 8 exploits (unknown). They also use social engineering tactics to trick users into running malware installers with '.SCR' extensions, which are sometimes packed with RAR.

Once a system is compromised, the attackers receive brief summary information from the victim and deliver pre-configured batch files containing a series of commands for execution. The Epic backdoor is also known as 'WorldCupSec', 'TadjMakhal', 'Wipbot' or 'Tadvig'.

The malware immediately connects to the command-and-control (C&C) server after infection, sending a pack with the victim's system information. The attackers then use this information to determine what malware to install on the device via Epic. Once installed, Epic initiates communications with Turla's command and control infrastructure before transmitting system and user information to the group.

Turla uses Yahoo Mail Archiver as a tool to gather sensitive information from compromised systems. This includes email accounts, passwords, and other valuable data that can be used for further attacks or espionage purposes.

In conclusion, Yahoo Mail Archiver is a sophisticated cyber-espionage tool developed by Turla to compromise systems and steal sensitive information. The group's use of various vectors, including watering hole attacks and social engineering tactics, makes them highly effective in delivering malware to unsuspecting victims. As cybersecurity threats continue to evolve, it is essential for individuals and organizations to stay vigilant and take steps to protect themselves from these types of attacks.

Yahoo mail archiver