Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Turla Outlook White Paper describes a threat associated with the Turla group, a well-known advanced persistent threat (APT) actor. This threat involves the exploitation of Microsoft Outlook through a technique known as Component Object Model (COM) hijacking (MITRE ATT&CK T1122). COM hijacking allows attackers to manipulate the way Outlook components are loaded and executed, enabling them to persist within the victim's environment and evade detection. The primary objective of this threat is email collection (MITRE ATT&CK T1114), which involves unauthorized access to and exfiltration of sensitive email communications. The attack targets sectors such as academic and research institutions and government entities, particularly within Western Europe. The threat is characterized by medium certainty and medium threat level, indicating that while the indicators of compromise (IOCs) and technical details are not fully confirmed, there is credible intelligence suggesting active targeting. No specific affected product versions or patches are identified, and no known exploits in the wild have been reported. The persistence mechanism through COM hijacking suggests a sophisticated approach to maintain long-term access and data collection capabilities. The lack of patch availability and the use of legitimate system components for hijacking complicate detection and mitigation efforts. Overall, this threat represents a targeted espionage campaign leveraging Outlook's architecture to harvest sensitive email data from high-value targets in Western Europe.

https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf

Detailed information about Turla Outlook White Paper. Get real-time updates, technical details, and mitigation strategies.

Turla Outlook White Paper - Live Threat Intelligence - Threat Radar | OffSeq.com

Turla Outlook White Paper

The Turla Outlook White Paper describes a campaign attributed to the Turla group, a well-known advanced persistent threat (APT) actor. This campaign leverages Component Object Model (COM) hijacking techniques (MITRE ATT&CK T1122) to compromise Microsoft Outlook and facilitate email collection (T1114). COM hijacking involves manipulating the Windows COM infrastructure to execute malicious code when a legitimate application, such as Outlook, invokes a COM object. By exploiting this mechanism, the threat actor can stealthily intercept and exfiltrate emails without triggering typical detection mechanisms. The campaign targets sectors including academic and research institutions as well as government entities, primarily within Western Europe. Although no specific affected software versions are listed, the focus on Outlook suggests exploitation of vulnerabilities or misconfigurations in Microsoft Outlook or its integration with Windows COM components. The campaign is classified as high severity by the source, with a medium threat level and medium IOC accuracy, indicating some uncertainty but credible risk. No known exploits in the wild have been reported, suggesting this may be a targeted or emerging threat rather than widespread malware. The campaign's persistence and stealth capabilities align with typical APT behaviors, emphasizing espionage objectives through email data collection. The use of COM hijacking is significant because it allows execution of malicious payloads with the privileges of the Outlook process, potentially bypassing security controls and evading detection. The campaign's targeting of Western European academic, research, and government sectors highlights a strategic focus on sensitive information and intellectual property.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="email collection"'

Filter Threats

Threats Tagged 'misp-galaxy:mitre-attack-pattern="email collection"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility