{"id":14206,"date":"2020-05-26T15:51:02","date_gmt":"2020-05-26T07:51:02","guid":{"rendered":"https:\/\/version-2.com\/?p=14206"},"modified":"2020-11-04T13:23:11","modified_gmt":"2020-11-04T05:23:11","slug":"cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/","title":{"rendered":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers"},"content":{"rendered":"
\n\t\t\t\t<\/p>\n

Bratislava, Montreal<\/strong>\u00a0\u2013 ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.<\/p>\n

<\/p>\n

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim\u2019s central MS SQL Server database containing the organization\u2019s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla\u2019s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.<\/p>\n

The fact that the attackers try to evade security software is concerning. \u201cThis shows the level of sophistication of this group and its intention to stay on the same machines for a long time,\u201d explains Matthieu Faou, who has investigated the infamous group for several years. \u201cAdditionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn\u2019t rely on any malicious domain,\u201d says Faou.<\/p>\n

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.\u201c<\/p>\n

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,\u201d says Faou.<\/p>\n

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.<\/p>\n

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper\u00a0From Agent.BTZ to ComRAT v4: a ten year journey<\/a>\u00a0on WeLiveSecurity. Make sure to follow\u00a0ESET research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p>\n

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About ESET<\/strong>
For 30 years, ESET\u00ae has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET\u2019s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24\/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single \u201cin-the-wild\u201d malware without interruption since 2003.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

Bratislava, Montreal<\/strong>\u00a0\u2013 ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.<\/p>\n

<\/p>\n

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim\u2019s central MS SQL Server database containing the organization\u2019s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla\u2019s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.<\/p>\n

The fact that the attackers try to evade security software is concerning. \u201cThis shows the level of sophistication of this group and its intention to stay on the same machines for a long time,\u201d explains Matthieu Faou, who has investigated the infamous group for several years. \u201cAdditionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn\u2019t rely on any malicious domain,\u201d says Faou.<\/p>\n

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.\u201c<\/p>\n

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,\u201d says Faou.<\/p>\n

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.<\/p>\n

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper\u00a0From Agent.BTZ to ComRAT v4: a ten year journey<\/a>\u00a0on WeLiveSecurity. Make sure to follow\u00a0ESET research on Twitter<\/a>\u00a0for the latest news from ESET Research.<\/p>\n

\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

About ESET<\/strong>
For 30 years, ESET\u00ae has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET\u2019s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24\/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single \u201cin-the-wild\u201d malware without interruption since 2003.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

Bratislava, Montreal\u00a0\u2013 ESET researchers have uncovered […]<\/p>","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[40,61,99],"tags":[98,41],"class_list":["post-14206","post","type-post","status-publish","format-standard","hentry","category-eset","category-press-release","category-year2020","tag-98","tag-eset"],"acf":[],"yoast_head":"\nCyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/version-2.com\/en\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2\" \/>\n<meta property=\"og:description\" content=\"Bratislava, Montreal\u00a0\u2013 ESET researchers have uncovered […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/version-2.com\/en\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-26T07:51:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-11-04T05:23:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"250\" \/>\n\t<meta property=\"og:image:height\" content=\"70\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers\",\"datePublished\":\"2020-05-26T07:51:02+00:00\",\"dateModified\":\"2020-11-04T05:23:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/\"},\"wordCount\":449,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"keywords\":[\"2020\",\"ESET\"],\"articleSection\":[\"ESET\",\"Press Release\",\"2020\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/\",\"url\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/\",\"name\":\"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"datePublished\":\"2020-05-26T07:51:02+00:00\",\"dateModified\":\"2020-11-04T05:23:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2020\\\/05\\\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/version-2.com\/en\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/","og_locale":"en_US","og_type":"article","og_title":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2","og_description":"Bratislava, Montreal\u00a0\u2013 ESET researchers have uncovered […]","og_url":"https:\/\/version-2.com\/en\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/","og_site_name":"Version 2","article_published_time":"2020-05-26T07:51:02+00:00","article_modified_time":"2020-11-04T05:23:11+00:00","og_image":[{"width":250,"height":70,"url":"https:\/\/version-2.com\/wp-content\/uploads\/2020\/04\/blog-v2-logo.jpg","type":"image\/jpeg"}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/#article","isPartOf":{"@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers","datePublished":"2020-05-26T07:51:02+00:00","dateModified":"2020-11-04T05:23:11+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/"},"wordCount":449,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"keywords":["2020","ESET"],"articleSection":["ESET","Press Release","2020"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/","url":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/","name":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"datePublished":"2020-05-26T07:51:02+00:00","dateModified":"2020-11-04T05:23:11+00:00","breadcrumb":{"@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/version-2.com\/2020\/05\/cyber-espionage-group-turla-a-k-a-snake-now-uses-gmail-web-interface-for-command-and-control-eset-discovers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-3H8","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=14206"}],"version-history":[{"count":6,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14206\/revisions"}],"predecessor-version":[{"id":20040,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/14206\/revisions\/20040"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=14206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=14206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=14206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}