Turla Hackers Exploit SharePoint Flaw to Compromise French Organizations
The Russian-linked Turla group leveraged a Microsoft SharePoint vulnerability to gain access to thousands of French user accounts and sensitive data.
The notorious Turla threat actor, widely believed to be affiliated with Russia's Federal Security Service (FSB), has once again surfaced in cybersecurity news, this time for exploiting a vulnerability in Microsoft SharePoint to compromise numerous French organizations. Investigators from France's Cyber Crisis Coordination Center (C4) and CERT-FR detailed the intrusions, which targeted not only high-profile government entities but also smaller businesses and associations, using them as stepping stones for further attacks.
Turla, a persistent espionage operation active for over two decades, is known for its stealthy data theft from government, diplomatic, defense, justice, and technology sectors. The group employs a diverse range of tactics, including phishing emails, compromised websites, vulnerable internet-facing systems, and compromised network equipment to establish an initial foothold. Their campaigns can begin with seemingly innocuous files or weakly secured servers, gradually expanding to deeper network access.
The specific campaign highlighted involved the exploitation of a Microsoft SharePoint vulnerability. This allowed Turla operators to install malware on compromised servers, potentially granting them access to information associated with thousands of user accounts. The report underscores how a single exposed collaboration platform can lead to significant privacy and security issues, extending far beyond the immediate server.
French investigators noted that the compromised systems were not always the final targets. Instead, intermediate victims often had their systems repurposed as hidden relays for subsequent attacks. This tactic makes attribution and detection more challenging, as a compromised organization might be unaware that its infrastructure is being used to facilitate attacks against others.
Turla is associated with a suite of custom malware, including Uroburos (also known as Snake) and Kazuar, with Kazuar reportedly remaining in use and evolving. The group also readily incorporates publicly available tools like Mimikatz and Metasploit into their operations when they can help blend malicious activity with legitimate administrative tasks.
The group's activities have continued to target Windows, Linux, and macOS environments, along with various enterprise applications and web servers. This broad targeting capability allows Turla to penetrate a wide array of organizations reliant on common enterprise tools. The ongoing conflict in Ukraine has seen Turla continue its operations against Ukraine, NATO countries, and EU member states, primarily focusing on intelligence collection.
For defenders, this incident serves as a critical reminder of the importance of timely security updates, particularly for internet-facing services like SharePoint. Organizations are urged to conduct regular account activity reviews, investigate unusual server behavior, restrict administrative access, and assess their networks for any signs of compromised systems being used as relays.
The French findings emphasize that cybersecurity incidents should not be viewed in isolation. When attackers compromise shared services used by many individuals, the potential impact can ripple across communications, identities, internal records, and future targeting opportunities, necessitating a comprehensive and proactive defense strategy.