Mandiant: Russian cyberespionage group Turla piggybacked on other hackers' decade-old malware that spread via USB drives to stealthily access victim networks
The infamous, FSB-connected Turla group took over other hackers' servers, exploiting their USB drive malware for targeted espionage.
Context & Ripple Effects
Mandiant's finding extends a documented Turla habit: the FSB-linked group has spent years operating through other people's infrastructure rather than its own, from hijacking satellite internet links to hide its whereabouts, to Gmail-based command-and-control and Dropbox exfiltration in campaigns against European governments (Gmail C2, Crutch). The new wrinkle is that the borrowed tooling here is another hacker's decade-old USB-spread malware, giving Turla access that looks like someone else's intrusion.
The pattern has since hardened into doctrine: Microsoft and Lumen's Black Lotus Labs later documented Turla running its own attacks off Pakistan-based Storm-0156's servers since December 2022 (Storm-0156 server hijacking), making this USB-malware piggyback an early data point in a sustained tradecraft shift.
First-order effects
- Victims infected by the original USB malware face a second, far better-resourced intruder riding the same foothold, while incident responders risk attributing Turla activity to the lesser-known group whose malware actually opened the door.
Second-order effects
- Threat-intelligence vendors like Mandiant, ESET, Kaspersky, and Microsoft must now fingerprint shared infrastructure and code reuse across groups, since Turla's server hijackings contaminate the attribution signals their detection products sell on.
Third-order effects
- If state espionage teams keep borrowing criminal groups' malware and servers as standard practice, the clean line between 'APT' and 'cybercrime' toolsets erodes, pushing the industry toward attribution models built on dual-use code intelligence rather than malware family names alone.
The trend: Russian state espionage is increasingly conducted through hijacked third-party and criminal infrastructure, trading operational convenience for attribution confusion among defenders.