LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0335: Carbon

Carbon is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive information from victims. Carbon has been selectively used by Turla to target government and foreign affairs-related organizations in Central Asia.[1][2]

EnterpriseS0335MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Carbon matters because ATT&CK describes it as a sophisticated second-stage Windows backdoor/framework used to steal sensitive information. For leaders, the key issue is not only malware prevention: a second-stage tool implies defenders need evidence that they can identify post-compromise discovery, persistence, command-and-control, staging, and exfiltration behavior before sensitive data loss becomes an incident response and compliance problem.

Executive priority

Treat Carbon-like behavior as a readiness test for high-value Windows environments and sensitive-data operations. Executives should ask whether SOC and IR teams can prove visibility into Windows service and scheduled task persistence, suspicious discovery activity, process injection indicators, outbound web or non-application-layer communications, local data staging, and exfiltration over unencrypted protocols. The Turla relationship and cited targeting of government and foreign-affairs-related organizations make this especially relevant for organizations with similar mission, policy, research, or diplomatic exposure, but local risk should be validated with environment-specific threat intelligence.

Technical view

ATT&CK provides no official detection text for Carbon, so defensive validation should be built from the mapped behaviors. On Windows, prioritize detection engineering around T1053.005 Scheduled Task, T1543.003 Windows Service, T1055.001 DLL Injection, T1012 Registry querying, T1057 Process Discovery, T1016/T1018/T1049 network and remote system discovery, T1069 permission group discovery, T1074.001 local staging, T1048.003 exfiltration over unencrypted non-C2 protocols, and C2 patterns involving T1071.001 Web Protocols, T1102 Web Service, T1095 Non-Application Layer Protocol, and T1573.002 Asymmetric Cryptography. Because T1027 and T1140 are also mapped, teams should expect analysis resistance and avoid depending on static signatures alone.

Likely telemetry

  • Windows event logs for service creation or modification and scheduled task registration or execution
  • Endpoint process telemetry including command line, parent-child process relationships, loaded modules, and suspicious cross-process activity relevant to DLL injection
  • Registry access and modification telemetry, especially around service configuration and system discovery patterns
  • File creation, rename, archive, and unusual directory activity that could indicate local data staging
  • Network telemetry from proxy, firewall, DNS, NetFlow, and packet metadata for outbound web traffic, web-service use, non-application-layer protocols, and unencrypted exfiltration paths

Detection direction

  • Build detections around behavior chains rather than a single indicator: persistence change followed by discovery, staging, C2-like outbound traffic, or exfiltration is more decision-useful than any event alone.
  • Baseline legitimate administrative use of scheduled tasks, services, registry queries, process listings, network configuration commands, and group enumeration to reduce false positives without suppressing rare activity on sensitive hosts.
  • Validate egress monitoring for both common web protocols and less common non-application-layer communications; Carbon’s mapped C2 techniques indicate that network controls should not rely only on destination reputation or protocol allowlisting.
  • Hunt for local staging followed by outbound transfer over unencrypted non-C2 protocols, especially from systems that normally should not aggregate or transmit sensitive files.
  • Account for obfuscation and deobfuscation: detections should include behavioral and memory/process evidence, not just file hashes or readable strings.

Mitigation priorities

  • Start with visibility assurance: confirm Windows endpoint logging, EDR coverage, network egress telemetry, and retention are sufficient to reconstruct persistence, discovery, C2, staging, and exfiltration activity.
  • Harden and monitor persistence surfaces by controlling who can create or modify Windows services and scheduled tasks, and by reviewing changes on high-value systems.
  • Limit outbound connectivity from sensitive Windows hosts to required destinations and protocols, with special attention to web traffic, web services, non-application-layer protocols, and unencrypted transfer paths.
  • Apply least privilege and identity hygiene so permission group discovery yields less useful follow-on targeting information and administrative actions are easier to distinguish from normal user behavior.
  • Prepare IR playbooks for second-stage backdoor scenarios: scope discovery activity, collect volatile endpoint evidence, review outbound traffic, identify staged data, and preserve audit evidence for legal, regulatory, or executive decision-making.
Additional notes and limits

Carbon is represented here as ATT&CK software S0335, a Windows malware object described as a second-stage backdoor and framework. The relationship set is rich enough to support a defensive coverage plan across discovery, persistence, stealth, command-and-control, collection, and exfiltration behaviors. The relationship to Turla provides useful prioritization context, but attribution should remain evidence-led during any investigation.

MITRE does not provide official detection guidance for this object, and the supplied object does not include aliases, labels, or malware-specific tactics. Several related techniques list broad platforms, but Carbon’s supplied platform is Windows, so platform-specific conclusions should be limited to Windows unless local evidence shows otherwise. Any detection logic requires local baselines, telemetry validation, and environment-specific tuning.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Carbon

Carbon is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive information from victims. Carbon has been selectively used by Turla to target government and foreign affairs-related organizations in Central Asia.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1053.005Scheduled TaskSub-technique

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.[1]

EnterpriseT1102Web Service

Carbon can use Pastebin to receive C2 commands.[3]

EnterpriseT1049System Network Connections Discovery

Carbon uses the netstat -r and netstat -an commands.[4]

EnterpriseT1012Query Registry

Carbon enumerates values in the Registry.[1]

EnterpriseT1069Permission Groups Discovery

Carbon uses the net group command.[4]

EnterpriseT1124System Time Discovery

Carbon uses the command net time \\127.0.0.1 to get information the system’s time.[4]

EnterpriseT1016System Network Configuration Discovery

Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.[1][4]

EnterpriseT1074.001Local Data StagingSub-technique

Carbon creates a base directory that contains the files and folders that are collected.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Carbon has used RSA encryption for C2 communications.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

Carbon decrypts task and configuration files for execution.[1][3]

EnterpriseT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique

Carbon uses HTTP to send data to the C2 server.[1]

EnterpriseT1018Remote System Discovery

Carbon uses the net view command.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

Carbon can use HTTP in C2 communications.[3]

EnterpriseT1027Obfuscated Files or Information

Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.[1][3]

EnterpriseT1095Non-Application Layer Protocol

Carbon uses TCP and UDP for C2.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Carbon has a command to inject code into a process.[1]

EnterpriseT1057Process Discovery

Carbon can list the processes on the victim’s machine.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1069: Permission Groups DiscoveryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1048.003: Exfiltration Over Unencrypted Non-C2 ProtocolEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1057: Process DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
dd9f4e0a991e7a75...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundledd9f4e0a991e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  2. [2]
    Securelist Turla Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 04). Shedding Skin – Turla’s Fresh Faces. Retrieved November 7, 2018.

    Open source URL
  3. [3]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  4. [4]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  5. [5]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  6. [6]
    Carbon

    (Citation: ESET Carbon Mar 2017)(Citation: Securelist Turla Oct 2018)

  7. [7]
    Carbon

    (Citation: ESET Carbon Mar 2017)(Citation: Securelist Turla Oct 2018)

  8. [8]
    Carbon

    (Citation: ESET Carbon Mar 2017)(Citation: Securelist Turla Oct 2018)

  9. [9]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  10. [10]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  11. [11]
    Securelist Turla Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 04). Shedding Skin – Turla’s Fresh Faces. Retrieved November 7, 2018.

    Open source URL
  12. [12]
    Securelist Turla Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 04). Shedding Skin – Turla’s Fresh Faces. Retrieved November 7, 2018.

    Open source URL
  13. [13]
    mitre-attackS0335
    Open source URL
  14. [14]
    mitre-attackS0335
    Open source URL
  15. [15]
    mitre-attackS0335
    Open source URL
  16. [16]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  17. [17]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  18. [18]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  19. [19]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  20. [20]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  21. [21]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  22. [22]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  23. [23]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  24. [24]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  25. [25]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  26. [26]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  27. [27]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  28. [28]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  29. [29]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  30. [30]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  31. [31]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  32. [32]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  33. [33]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  34. [34]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  35. [35]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  36. [36]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  37. [37]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  38. [38]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  39. [39]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  40. [40]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  41. [41]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  42. [42]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  43. [43]
    GovCERT Carbon May 2016

    GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.

    Open source URL
  44. [44]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  45. [45]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  46. [46]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  47. [47]
    Accenture HyperStack October 2020

    Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.

    Open source URL
  48. [48]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  49. [49]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  50. [50]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  51. [51]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  52. [52]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  53. [53]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  54. [54]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  55. [55]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  56. [56]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
  57. [57]
    ESET Carbon Mar 2017

    ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use