Turla has extensively used Carbon, a modular backdoor framework with advanced peer-to-peer capability, for several years. A June 2020 analyzed instance of the Carbon backdoor augmented the traditional threat actor-owned C&C infrastructure with tasks served from Pastebin, a legitimate web service. The Carbon installer discovered by ACTI analysts dropped a Carbon Orchestrator, two communication modules, and an encrypted configuration file