With initial access secured, Turla deploys a remote access tool to execute commands and further their control over the infected endpoint. Anomalous execution detected on endpoint with associated malicious artifacts.