Symantec partners with Message Systems

A notorious Kremlin-backed hacking group is using a legitimate network service to coordinate targeted attacks.

After achieving initial access to a Storm-0156 C2 server in December 2022, Turla sought to take over more of the Pakistani threat operation's C2s to compromise Afghan government organizations' networks with the TwoDash downloader and Statuezy trojan.

China-based threat actor targeted Exchange servers, suggesting they aimed to gather intelligence by harvesting emails.