Remove Turian Backdoor

The Turian Backdoor is the primary implant used by a newly identified Advanced Persistent Threat (APT), the  that targets diplomatic entities in Africa and the Middle East. On top of the political targets, the BackdoorDiplomacy APT criminals also have gone after companies in the telecommunications and humanitarian sector. The hackers are focusing on Linux and Windows operating systems, but the Turian Backdoor, in particular, is compatible with Windows.

Allegedly, the criminals are not that crafty when it comes to malware development, and they have used a relatively old backdoor project as the foundation for their implant – the Quarian backdoor. The latter was first used in 2013.

But what does the Turian Backdoor support nowadays? Its primary features include the ability to identify and collect data from the compromised system, grab screenshots and manage the file system. Furthermore, the criminals are using the Turian Backdoor to deploy additional intrusive software to the infected system – such as the MimiKatz credential recovery tool. The criminals seem to be rather resourceful when it comes to exploring publicly available utilities and exploits – they have also used the EternalBlue and DoublePulsar exploits that were leaked by the ShadowBrokers group.

The primary goal of the BackdoorDiplomacy APT appears to be data theft – they rely on the Turian Backdoor to gather files from the infected system, as well as from flash drives connected to the device. Modern anti-malware software suites can identify and eliminate the Turian Backdoor easily, therefore keeping users safe.