Russia's Turla APT Abuses MSBuild to Deliver TinyTurla Backdoor

A Russia-linked APT (Turla) is conducting a targeted campaign against individuals and entities in the Philippines by sending socially engineered emails containing malicious .LNK files that write lure PDFs, encrypted data, and MSBuild project files to %temp%, then use MSBuild and PowerShell to deploy the TinyTurla fileless backdoor; the backdoor supports remote command execution, file upload/download, sleep adjustments, and uses PHP-based C2 infrastructure on compromised servers. Researchers recommend strong email filtering, restricting MSBuild usage, and limiting PowerShell execution to reduce risk.