S0199: TURNEDUP
TURNEDUP is a non-public backdoor. It has been dropped by APT33's StoneDrill malware. [1] [2]
Security context for executives and security teams
TURNEDUP matters because it is described by ATT&CK as a non-public Windows backdoor associated through reporting with APT33 activity and dropped by StoneDrill malware. For leaders, the practical issue is not broad commodity malware coverage; it is whether Windows endpoint, persistence, process-injection, command execution, tool-transfer, discovery, and screen-capture visibility would let the organization recognize and contain a post-compromise backdoor in a higher-consequence environment such as aviation or energy, where APT33 has been reported to show interest.
Executive priority
Prioritize validation of Windows endpoint monitoring and incident response readiness for backdoor behaviors rather than relying on a named-malware signature. The ATT&CK record provides no official detection guidance, so assurance should come from evidence that SOC teams can see and investigate the related behaviors: APC-based process injection, cmd.exe execution, system information discovery, inbound tool transfer, screen capture, and Run key or Startup Folder persistence. This is especially relevant for organizations using ATT&CK to support audit evidence, resilience planning, and threat-informed control prioritization in sectors where APT33 reporting is relevant.
Technical view
Treat TURNEDUP as a behavior-led detection and response use case for Windows. Validate telemetry and analytics around T1055.004 Asynchronous Procedure Call injection, T1059.003 Windows Command Shell execution, T1082 System Information Discovery, T1105 Ingress Tool Transfer, T1113 Screen Capture, and T1547.001 Registry Run Keys / Startup Folder. Because ATT&CK does not provide official detection text for this malware, SOC and IR teams should map local detections to those related techniques, confirm they can pivot from persistence or process-injection signals to command execution, file transfer, discovery, and collection activity, and avoid assuming that malware-name detections alone provide coverage.
Likely telemetry
- Windows endpoint process creation and parent-child process relationships, especially cmd.exe activity
- Endpoint telemetry for process injection or suspicious cross-process memory/thread activity relevant to APC injection
- Windows Registry monitoring for Run key changes and Startup Folder file creation
- File creation, download, and transfer evidence for tools or payloads entering hosts
- Host and network logs showing command-and-control-adjacent file transfer patterns, where available
Detection direction
- Build detection coverage around the related ATT&CK techniques rather than the TURNEDUP name, since the official object provides no detection section.
- Tune Windows Command Shell detections for unusual execution context, uncommon parent processes, service or persistence-launched shells, and activity chained with discovery or transfer behavior.
- Validate detection of Run key and Startup Folder persistence, with allowlisting for legitimate software updaters and administrative tooling to reduce false positives.
- Confirm endpoint controls can surface APC-style injection or comparable process-injection telemetry; this is a common blind spot if relying only on basic process logs.
- Correlate possible tool transfer with subsequent command execution, discovery, or screen capture, because individual file downloads may be benign without behavioral context.
Mitigation priorities
- Harden and monitor Windows persistence locations, especially Registry Run keys and Startup Folders.
- Limit unnecessary command-shell access through least privilege, application control, and administrative policy where operationally feasible.
- Ensure endpoint protection and EDR capabilities are configured to capture process-injection, process execution, file creation, and registry modification events.
- Restrict and monitor unauthorized tool ingress through network controls, egress governance, and host-based file execution policy.
- Prepare IR playbooks for backdoor investigations that include host isolation, persistence review, process tree analysis, credential exposure assessment, and scoping across similarly configured Windows systems.
Additional notes and limits
The ATT&CK record identifies TURNEDUP as a non-public backdoor dropped by StoneDrill and links it to APT33 reporting. The relationship set supplies the most useful defensive context: process injection via APC, Windows command shell execution, system information discovery, ingress tool transfer, screen capture, and Run key or Startup Folder persistence. Glexia would treat this as a control-validation scenario for Windows backdoor tradecraft and SOC correlation, not as a standalone indicator package.
The supplied ATT&CK object has no official detection guidance, no aliases, no explicit tactics on the malware object, and only Windows listed as the malware platform. The related techniques include broader platform metadata, but platform conclusions for TURNEDUP should remain Windows-focused. Local telemetry, asset criticality, business sector, and incident evidence are required before making any claim about exposure, exploitation, attribution, or detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
TURNEDUP
TURNEDUP is a non-public backdoor. It has been dropped by APT33's StoneDrill malware. [1] [2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1055.004 | Asynchronous Procedure CallSub-technique | |
| Enterprise | T1113 | Screen Capture | |
| Enterprise | T1105 | Ingress Tool Transfer | |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | |
| Enterprise | T1082 | System Information Discovery | |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique |
Groups, software, and campaigns
G0064: APT33
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | e30b2102f8d7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [2]FireEye APT33 Webinar Sept 2017
Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
Open source URL - [3]CyberBit Early Bird Apr 2018
Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’ Code Injection Technique Discovered. Retrieved May 24, 2018.
Open source URL - [4]Symantec Elfin Mar 2019
Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
Open source URL - [5]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [6]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [7]FireEye APT33 Webinar Sept 2017
Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
Open source URL - [8]FireEye APT33 Webinar Sept 2017
Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
Open source URL - [9]TURNEDUP
(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
- [10]TURNEDUP
(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
- [11]TURNEDUP
(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
- [12]mitre-attackS0199Open source URL
- [13]mitre-attackS0199Open source URL
- [14]mitre-attackS0199Open source URL
- [15]CyberBit Early Bird Apr 2018
Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’ Code Injection Technique Discovered. Retrieved May 24, 2018.
Open source URL - [16]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [17]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [18]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [19]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [20]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [21]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [22]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [23]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [24]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [25]FireEye APT33 Sept 2017
O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
Open source URL - [26]FireEye APT33 Webinar Sept 2017
Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
Open source URL - [27]FireEye APT33 Webinar Sept 2017
Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
Open source URL - [28]Symantec Elfin Mar 2019
Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
Open source URL - [29]CyberBit Early Bird Apr 2018
Gavriel, H. & Erbesfeld, B. (2018, April 11). New ‘Early Bird’ Code Injection Technique Discovered. Retrieved May 24, 2018.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.