To confound detection, its operators recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. We will also present various payloads, including an RPC-based backdoor and a backdoor leveraging OneDrive as its Command and Control (C&amp;C) server. Then, it calls VirtualProtect to allow writing at the retrieved address. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. RPC backdoor . Turla has developed a whole set of backdoors relying on the RPC protocol. OneDrive credentials in PowerStallion script . It is interesting to note that Turla operators used the free email provider GMX again, as in the Outlook Backdoor and in LightNeuron. Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. Modification of MAC times of the local log file . We believe this backdoor is a recovery access tool in case the main Turla backdoors, such as Carbon or Gazer, are cleaned and operators can no longer access the compromised computers. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools