Russia Hackers Using TinyTurla-NG to Breach European NGO's Systems

**Cisco Talos** attributes a targeted campaign to the Russia-linked APT group Turla that compromised systems at a European NGO and deployed the TinyTurla-NG backdoor; attackers created Microsoft Defender exclusions, established persistence via a masquerading "sdm" service, and used a custom Chisel tunnel for lateral movement and data exfiltration, with activity observed from October 2023 through January 2024.