Microsoft and Lumen's Black Lotus Labs find Russia-linked Turla hackers hijacked Pakistan-based hackers' servers to launch their own attacks since December 2022

The notorious Russian cyber-espionage group Turla is hacking other hackers, hijacking the Pakistani threat actor Storm-0156's infrastructure …

BleepingComputer 2024-12-05 Bill Toulas

Context & Ripple Effects

Turla has repeatedly used others’ infrastructure or tooling to conceal its operations: related coverage documented its reuse of malware from another hacking operation and earlier use of hijacked satellite internet links for anonymity.

The reported takeover of Storm-0156 servers extends that operational pattern from borrowed access and communications channels to another threat actor’s active infrastructure. It matters because infrastructure ownership becomes a weaker signal of who is actually behind an intrusion.

First-order effects

Storm-0156’s server infrastructure was used by Turla, compromising the Pakistani group’s operational control and obscuring the origin of attacks launched from those systems.
Microsoft and Lumen’s finding gives defenders a concrete reason to reassess activity associated with the hijacked servers rather than attributing it solely to their apparent operators.

Second-order effects

Threat-intelligence teams will need to weigh malware, tactics, and command patterns more heavily than server ownership when separating overlapping campaigns.
Hosting and network defenders may face a more complex cleanup task: removing one actor from compromised servers may not reveal or evict every group using the same infrastructure.

Third-order effects

If this pattern broadens, criminal and state-linked infrastructure will increasingly function as a contested intermediary layer, making conventional infrastructure-based attribution less reliable.
The durable shift is toward attribution built from corroborated behavioral evidence rather than single indicators such as an IP address, domain, or server operator.

The trend: This is a data point in the broader trend of advanced threat groups treating other actors’ compromised infrastructure as a reusable anonymity and access layer.

Discussion

@lukaszolejnik Lukasz Olejnik on bluesky
Russian cyber threat actor Turla hacked 33 infrastructure nodes of Pakistani-based cyber threat actor, “Storm-0156” to attack other targets, to deploy their own cyber tools (malware) for cyber-espionage purposes vs Afghan government and India. It delays attribution. blog.lumen.c…
@hultquist John Hultquist on bluesky
Second time we've seen Turla sit on top of someone else's operation. blog.lumen.com/snowblind-th...
@pylos.co Joe Slowik on bluesky
This is really neat: — blog.lumen.com/snowblind-th...
@loumariehsd Louise Marie Hurel on x
FSB's Center 16 tracked as Secret Blizzard/Turla has used the tools and infrastructure of at least 6 other threat actors during the past 7 years for the exclusive purpose of facilitating espionage operations. https://www.microsoft.com/...
@greglesnewich Greg Lesnewich on x
holy smokes the MSFT and Lumen reporting on Turla have some bomb shells - co-opting SideCopy infrastructure - borrowed Tomiris from another actor to load their tooling - SideCopy was in the parking lot of targets to pop em? https://blog.lumen.com/... https://www.microsoft.com/..…
@msftsecintel @msftsecintel on x
Based on our findings and those reported by governments and other security vendors, Microsoft Threat Intelligence assesses the Russian nation-state actor we track as Secret Blizzard has used the tools and infrastructure of at least 6 other threat actors during the past 7 years.

Chronicles