Turla hackers backdoor NGOs with new TinyTurla-NG malware

Cisco Talos researchers discovered and analyzed TinyTurla-NG, a service DLL backdoor, and TurlaPower-NG PowerShell scripts used by the Russia-linked Turla APT to maintain persistence and exfiltrate sensitive data (notably password-manager master passwords) from NGOs; the campaign used compromised, vulnerable WordPress sites as C2/hosting and Talos published IOCs and a technical report detailing commands, functionality, and timeline.