Threat intelligence / Group

Turla

[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

98 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Arp

Tool

uses

to Bidirectional Communication

Technique

uses

to Brute Force

Technique

uses

to Carbon

Malware

uses

to certutil

Tool

uses

to Code Signing Policy Modification

Technique

uses

to Command Obfuscation

Technique

uses

to ComRAT

Malware

uses

to Create Process with Token

Technique

uses

to Crutch

Malware

uses

to Databases

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to Drive-by Compromise

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Empire

Tool

uses

to Epic

Malware

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File and Directory Discovery

Technique

uses

to Fileless Storage

Technique

uses

to File/Path Exclusions

Technique

uses

to Gazer

Malware

uses

to Group Policy Discovery

Technique

uses

to HyperStack

Malware

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Proxy

Technique

uses

to Internet Connection Discovery

Technique

uses

to IronNetInjector

Tool

uses

to JavaScript

Technique

uses

to Kazuar

Malware

uses

to KOPILUWAK

Malware

uses

to Lateral Tool Transfer

Technique

uses

to LightNeuron

Malware

uses

to Local Account

Technique

uses

to Local Accounts

Technique

uses

to Local Groups

Technique

uses

to LunarLoader

Malware

uses

to LunarMail

Malware

uses

to LunarWeb

Malware

uses

to Mail Protocols

Technique

uses

to Malicious Link

Technique

uses

to Malware

Technique

uses

to Malware

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to Mosquito

Malware

uses

to Native API

Technique

uses

to NBTscan

Tool

uses

to nbtstat

Tool

uses

to Net

Tool

uses

to netstat

Tool

uses

to Password Policy Discovery

Technique

uses

to Penquin

Malware

uses

to Peripheral Device Discovery

Technique

uses

to PowerShell

Technique

uses

to PowerShell Profile

Technique

uses

to PowerStallion

Malware

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Proxy

Technique

uses

to PsExec

Tool

uses

to Python

Technique

uses

to Query Registry

Technique

uses

to Reg

Tool

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to Security Software Discovery

Technique

uses

to Server

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Spearphishing Link

Technique

uses

to Systeminfo

Tool

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Tasklist

Tool

uses

to TinyTurla

Malware

uses

to Tool

Technique

uses

to Uroburos

Malware

uses

to Virtual Private Server

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Web Service

Technique

uses

to Web Services

Technique

uses

to Web Services

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Credential Manager

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

to Winlogon Helper DLL

Technique

24 external

References

mitre-attack

G0010

open

BELUGASTURGEON

—

Krypton

—

Snake

—

Venomous Bear

—

Turla

—

Group 88

—

Secret Blizzard

—

IRON HUNTER

—

Accenture HyperStack October 2020

https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity

open

Waterbug

—

Talos TinyTurla September 2021

https://blog.talosintelligence.com/2021/09/tinyturla.html

open

ESET Turla Mosquito Jan 2018

https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf

open

ESET Gazer Aug 2017

https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf

open

ESET Turla PowerShell May 2019

https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/

open

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf

open

Securelist WhiteBear Aug 2017

https://securelist.com/introducing-whitebear/81638/

open

Kaspersky Turla

https://securelist.com/the-epic-turla-operation/65545/

open

Leonardo Turla Penquin May 2020

https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf

open

CrowdStrike VENOMOUS BEAR

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Secureworks IRON HUNTER Profile

http://www.secureworks.com/research/threat-profiles/iron-hunter

open

Symantec Waterbug

https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1

open

WhiteBear

—