LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0647: Turian

Turian is a backdoor that has been used by BackdoorDiplomacy to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, Turian is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.[1]

EnterpriseS0647MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Turian is a Windows and Linux backdoor associated in ATT&CK with BackdoorDiplomacy, a cyber espionage group reported to target foreign affairs ministries, telecommunications companies, and charities across several regions. Its practical significance is not just the malware name: the mapped behaviors show a post-compromise toolset for discovery, command execution, persistence, collection, staging, and web-based command-and-control that may blend with normal traffic and use obfuscation.

Executive priority

Treat Turian as a planning reference for espionage-style intrusion readiness, especially where diplomatic, telecom, charity, or similarly sensitive operations are in scope. Leaders should ask whether endpoint, identity, and network teams can prove visibility across Windows and Linux hosts for persistence, shell execution, local data staging, screenshots, archive creation, and web-protocol command-and-control. This object is also useful for audit and tabletop evidence: it highlights whether the organization can reconstruct attacker activity after a backdoor is present, not just block initial access.

Technical view

ATT&CK provides no official detection text for Turian, so validation should be relationship-driven. SOC and IR teams should map coverage to the techniques Turian uses: web C2 with junk data, network/system/user/file/peripheral discovery, Windows and Unix shell execution, Python execution, tool transfer, local staging, screen capture, deobfuscation, archive creation, masqueraded tasks/services, and Windows Run Key/Startup Folder persistence. On Windows, prioritize process, command-line, registry, service/task, file, and network telemetry. On Linux, prioritize shell execution, Python use, file staging, archive utilities, persistence/service naming anomalies where applicable, and outbound web traffic inspection metadata.

Likely telemetry

  • Endpoint process creation and command-line telemetry for cmd, Unix shells, Python, archive utilities, discovery commands, and file transfer activity
  • Windows Registry monitoring for Run Keys and Startup Folder persistence paths
  • Service, scheduled task, or system service metadata sufficient to identify masqueraded names or suspicious creation/modification
  • File creation, modification, and directory enumeration telemetry for local staging, archives, transferred tools, and decoded or deobfuscated payloads
  • Network telemetry for HTTP/S or other web-protocol command-and-control patterns, including unusual destinations, timing, user-agent/header anomalies, and payload size irregularities

Detection direction

  • Build detections around behavior chains rather than the malware name alone: discovery followed by shell/Python execution, tool transfer, staging, archiving, and outbound web traffic is more actionable than any single event.
  • Tune web-protocol C2 analytics for abnormal client behavior and junk-data-like irregularities while accounting for legitimate web applications that may generate noisy or variable traffic.
  • Validate Windows persistence coverage for Run Keys and Startup Folder entries, especially when paired with newly written binaries, scripts, or masqueraded task/service names.
  • Review false positives from administrators, software deployment tools, backup agents, and monitoring scripts that legitimately run discovery, shell, Python, archive, or transfer utilities.
  • Because ATT&CK provides no Turian-specific detection guidance, use local baselines, known-good administrative activity, and incident response findings to refine alerts.

Mitigation priorities

  • Prioritize visibility first: confirm endpoint and network logging exists for the Windows and Linux behaviors mapped to Turian before assuming coverage.
  • Harden persistence surfaces, especially Windows Run Keys/Startup Folder and task or service creation paths, with change monitoring and least-privilege administration.
  • Restrict and monitor script and shell execution where operationally feasible, including Python and command interpreters on systems that do not require them.
  • Apply egress control and proxy inspection policies that make unusual web-protocol command-and-control easier to identify and contain.
  • Limit local data staging and archive abuse through least privilege, sensitive data access controls, and monitoring of unusual archive creation or bulk file movement.
Additional notes and limits

The strongest defensive value comes from the ATT&CK relationships, not from a Turian-specific detection paragraph. The mapped techniques describe a backdoor capable of reconnaissance, execution, persistence, collection, and command-and-control behaviors that are common in hands-on intrusion activity. BackdoorDiplomacy is the related group in the supplied relationship context, and the official description cites reported targeting of ministries of foreign affairs, telecommunications companies, and charities.

No official ATT&CK detection text, aliases, labels, or malware-specific indicators were supplied. The malware object lists Windows and Linux platforms and no explicit tactics; tactics are inferred only from related technique context. This take does not assert current activity, customer exposure, guaranteed detection, or indicators beyond the supplied ATT&CK fields and references.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Turian

Turian is a backdoor that has been used by BackdoorDiplomacy to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, Turian is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.004Unix ShellSub-technique

Turian has the ability to use /bin/sh to execute commands.[1]

EnterpriseT1083File and Directory Discovery

Turian can search for specific files and list directories.[1]

EnterpriseT1027Obfuscated Files or Information

Turian can use VMProtect for obfuscation.[1]

EnterpriseT1113Screen Capture

Turian has the ability to take screenshots.[1]

EnterpriseT1033System Owner/User Discovery

Turian can retrieve usernames.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Turian can establish persistence by adding Registry Run keys.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

Turian can use WinRAR to create a password-protected archive for files of interest.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.[1]

EnterpriseT1016System Network Configuration Discovery

Turian can retrieve the internal IP address of a compromised host.[1]

EnterpriseT1059.006PythonSub-technique

Turian has the ability to use Python to spawn a Unix shell.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Turian can store copied files in a specific directory prior to exfiltration.[1]

EnterpriseT1001.001Junk DataSub-technique

Turian can insert pseudo-random characters into its network encryption setup.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Turian has the ability to use HTTP for its C2.[1]

EnterpriseT1105Ingress Tool Transfer

Turian can download additional files and tools from its C2.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Turian can create a remote shell and execute commands using cmd.[1]

EnterpriseT1082System Information Discovery

Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Turian can disguise as a legitimate service to blend into normal operations.[1]

EnterpriseT1120Peripheral Device Discovery

Turian can scan for removable media to collect data.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · GroupG0135: BackdoorDiplomacyEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1001.001: Junk DataEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
edc9bb48be3ca7e5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleedc9bb48be3c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  2. [2]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  3. [3]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  4. [4]
    mitre-attackS0647
    Open source URL
  5. [5]
    mitre-attackS0647
    Open source URL
  6. [6]
    mitre-attackS0647
    Open source URL
  7. [7]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  8. [8]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  9. [9]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  10. [10]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  11. [11]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  12. [12]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  13. [13]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  14. [14]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  15. [15]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  16. [16]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  17. [17]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  18. [18]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  19. [19]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  20. [20]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  21. [21]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  22. [22]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  23. [23]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  24. [24]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  25. [25]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  26. [26]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  27. [27]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  28. [28]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  29. [29]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  30. [30]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  31. [31]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  32. [32]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  33. [33]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  34. [34]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  35. [35]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  36. [36]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  37. [37]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  38. [38]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  39. [39]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  40. [40]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  41. [41]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
  42. [42]
    ESET BackdoorDiplomacy Jun 2021

    Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use