Loading malware…
KopiLuwak is a JavaScript-based Turla malware used primarily as an early-stage reconnaissance, victim-profiling, and staging backdoor in espionage operations. Public reporting has linked it to the Russian state-aligned Turla cluster, also tracked as Snake, Uroburos, Venomous Bear, Waterbug, and Secret Blizzard. Its observed targeting has centered on government, diplomatic, and foreign ministry entities, particularly in Europe, with later reporting also tying its use to operations involving Ukrainian organizations and broader government-focused campaigns.
KopiLuwak has been delivered through malicious email attachments, including macro-enabled Microsoft Office documents used in spearphishing campaigns, and has also been deployed by intermediary droppers such as .NET/MSIL loaders and self-extracting archives in multi-stage intrusion chains. In some campaigns, decoy diplomatic or policy-themed documents were used to lure victims into execution. Turla has also incorporated KopiLuwak into broader toolchains that include trojanized installers and follow-on implants.
Once executed, KopiLuwak performs host and network reconnaissance by invoking native Windows commands to collect system, user, process, and network-share information, including discovery of current TCP connections and user context. It stages command output locally, encrypts collected data in memory, and exfiltrates the results to command-and-control infrastructure over HTTP POST. Observed variants generate victim-specific identifiers and communicate with actor-controlled endpoints hosted on compromised legitimate websites.
KopiLuwak supports persistence in some variants through mechanisms such as Run key registration or scheduled tasks. Beyond profiling, it can receive tasking from command and control to execute arbitrary commands or scripts, and later variants added file upload and download functionality, reinforcing its role as a lightweight backdoor and staging implant. Reporting consistently characterizes it as a reconnaissance-focused foothold used to assess victims and enable deployment of more capable Turla malware in subsequent stages.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since the end of November 2016, Kaspersky Lab has observed Turla using this new JavaScript payload and specific macro variant.
"KOPILUWAK is a JavaScript-based reconnaissance utility used to facilitate C2 communications and victim profiling."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Assuming this variant of KopiLuwak has been observed in the wild, there are a number of ways it may have been delivered including some of Turla’s previous attack methods such as spear phishing or via a watering hole.
Scr.js first creates a scheduled task named PolicyConverter for persistence. This scheduled task should execute shortly after being created and is then scheduled to run every 10 minutes.
The “work” command is used to task the victim’s system to run arbitrary commands via Wscript.shell.run().
After establishing its persistence, it will then execute a series of commands on the victim system using “cmd.exe /c”
The document contains a malicious macro... the macro did contain a few modifications to it, mainly the XOR routine used to decode the initial JavaScript and the use of a “marker” string to find the embedded payload in the document.
The end result is a JavaScript file (mailform.js – MD5: 05d07279ed123b3a9170fa2c540d2919) written to “%APPDATA%MicrosoftWindows”. This file is then executed using Wscript.Shell.Run().
The content repeatedly describes victims being lured into opening malicious attachments, enabling macros, launching installers, clicking embedded files/links, or otherwise directly executing malicious content.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
After establishing its persistence, it will then execute a series of commands... net view net view /domain netstat -nao arp -a net share net use
tasklist /v ... tasklist /fi “modules eq wow64.dll” tasklist /fi “modules ne wow64.dll”
After establishing its persistence, it will then execute a series of commands on the victim system using “cmd.exe /c”... systeminfo
dir %systemdrive%\Users\*.* dir %userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.* dir %userprofile%\Desktop\*.* dir “%programfiles(x86)%” dir “%programfiles%” dir %appdata%
net user net user administrator net user /domain net user administrator /domain
Next, the hardcoded key “ Prc1MHxF_VB0ht7S ” is used to encode the infected system’s OS installation date
Despite moving the machine fingerprinting code to the dropper, all of the commands are the same as in the older sample (and executed in the same order) except for the following three additions: dir “%programfiles%\Kaspersky Lab” dir “%programfiles(x86)%\Kaspersky Lab”
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A JavaScript payload/backdoor used by Turla in espionage campaigns.
A Turla JavaScript backdoor used as a stage-1 delivery mechanism and victim profiler. It establishes persistence, profiles the host with system and network commands, encrypts collected data, beacons to hard-coded C2 servers, and can execute arbitrary commands via Wscript.
Malware executed through malicious attachments.
An obfuscated JavaScript trojan used by Turla that fingerprints hosts, communicates with C2 (including via compromised WordPress infrastructure), executes server-provided JavaScript, and can load/run additional payloads stored in the Windows registry as part of a fileless multi-stage chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.