Turla Backdoor Evades Detection Via MSBuild Exploit

This Cyble report describes a phishing campaign delivering a Tiny Backdoor via malicious .LNK files that extract a lure PDF, encrypted payloads and MSBuild project files; MSBuild.exe is abused to execute inline tasks in-memory resulting in a persistent, remote-control backdoor communicating with a compromised C2 domain (ies.inquirer.com.ph). The report includes step‑by‑step technical analysis, IOCs (hashes and domain), a YARA rule, MITRE ATT&CK mappings, mitigation recommendations, and attributes the activity to the Turla APT with medium confidence.