As many have heard/read the news, a module of the state-sponsored trojan malware named "Turla" was recently discovered which infects Linux hosts: (News from ArsTechnica) (News from OMG-Ubuntu) (Technical Report by Kaspersky)

In the ArsTechnica article, it is mentioned that:

Administrators who want to check for Turla-infected Linux systems can check outgoing traffic for connections to news-bbc.podzone[.]org or, ... Admins can also build a signature using a tool called YARA that detects the strings "TREX_PID=%u" and "Remote VS is empty !"

This short explanation doesn't really help me to figure out how I should check if my system is infected or not!

So can someone give a clear step-by-step explanation?

UPDATE: Although there seems to be no absolute method for detecting the infection, but a clear and step-by-step explanation using convenient tools for network monitoring to detect connections to the above-mentioned addresses (e.g. vnstat, netstat, ...) and steps using convenient tools for blocking connection to and from the above-mentioned addresses (e.g. ufw, iptables, ...) is greatly appreciated and DESIRED!


I just did a write-up on Turla yesterday over at security.stackexchange.com, covering both Windows and Linux versions. You can find it here.

Good news, by reading it you can get a better idea of what the Turla family is capable of.
Bad news, "Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet." - Kaspersky Lab

That means that the only analysis done so far has been from malware captured in a honeypot, and that it is very hard to detect. If you are interested, I have highlighted some of the anti-detection methods it is known to use in my write-up.

I think you will find there really isn't much more you can do at the moment besides what you already found in the article.

  • Thank you for the informative write-up. Although, this is bad news! :( – Seyed Mohammad Dec 11 '14 at 8:06
  • @SeyedMohammad Indeed! If you are able to block the traffic from the first hardcoded C&C connection, you should be safe from future attacks (at least until a revision is made). Some relief though, it seems that with how much input is required from the C&C and how long their campaigns run for (years), the owners are very picky about their targets. – cremefraiche Dec 11 '14 at 8:17
  • Of course, an answer that would clearly outline the steps to perform the DETECTION using any network monitoring tool (e.g. vnstat, netstat, ...), and the steps to perform for PREVENTION, using any firewall tool (e.g. ufw, iptables, ...) is greatly appreciated and DESIRED! – Seyed Mohammad Dec 11 '14 at 10:02
  • The only information available at this time is in the link you posted from Kaspersky Labs in your question. Anything anyone could tell you would come from that document, becuase Kaspersky is the only group to complete an analysis so far on the linux version. As stated in the report, Turla is immune to netstat, it breaks debugging, and constantly process hops. This is close to, if not the most sophisticated malware in the world. There is no easy solution to detecting and preventing it. Your question already includes the only available answer, which is block the suggested traffic. – cremefraiche Dec 11 '14 at 10:16
  • 2
    So we can conclude: lots of chatter but still not a single machine found that was compromised. PM me when someone does. – Rinzwind Dec 11 '14 at 15:24

Using iptables:

sudo su
iptables -A OUTPUT -s  -j DROP
iptables -A INPUT  -s  -j DROP

Be sure to check these lines are loaded after reboot (e.g. in crontab use @reboot).

  • More explanation is necessary – waltinator Aug 4 '17 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.