TinyTurla-NG in-depth tooling and command and control analysis

**Executive summary:** Cisco Talos, working with CERT.NGO, analyzes a Turla APT campaign that abused compromised WordPress sites as PHP-based C2/web shells to manage TinyTurla-NG and TurlaPower-NG implants, used PowerShell modules for file enumeration, staging, and exfiltration (including credential harvesting of Edge/Chrome and Firefox profiles), and deployed a modified Chisel tunneling client plus a privilege-impersonation tool; the report includes detailed C2 behavior and IOCs (file hashes, domains, and IP 91.193.18.120).