Russian group Turla has continued to improve its Carbon backdoor, experts from ESET detected new versions released on a regular basis. Turlas arsenal is composed of sophisticated hacking tools and malware tracked as Turla (Snake and Uroburos rootkit), Epic Turla, Wipbot and Gloog Turla. In June 2016, researchers from Kaspersky reported that the Turla APT had started using Icedcoffee, a JavaScript payload delivered via macro-enabled Office documents.”]
Source: https://securityaffairs.co/wordpress/57579/cyber-warfare-2/turla-carbon-backdoor.html