G0010 - Turla

Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. Turla’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.

Author
agomez
Created
2023-08-14 15:38:06
Last updated
2026-02-07 19:02:08
Downloads
305746
Hostname indicators
181
URL indicators
3
Sample indicators
290

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

test.support Hostname

modified 2026-10-17 08:40:32
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

ns-3.open.ro Hostname

modified 2026-10-17 08:37:56
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autoconfig.host Hostname

modified 2026-10-17 03:31:57
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

microsoft.updatemeltdownkb7234.com Hostname

modified 2026-10-17 00:39:57
Turla (Maltiverse) · OilRig (Maltiverse) · Malware site (Hybrid-Analysis)

autoconfig.email Hostname

modified 2026-10-17 00:39:46
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

mail.news Hostname

modified 2026-10-17 00:36:15
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.store Hostname

modified 2026-10-17 00:35:59
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

ns-2.open.ro Hostname

modified 2026-10-16 20:38:41
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

made.by Hostname

modified 2026-10-16 20:38:17
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

admin.dev Hostname

modified 2026-10-16 20:36:40
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.it Hostname

modified 2026-10-16 20:35:30
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webdisk.cn Hostname

modified 2026-10-16 20:35:19
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

39e7b647523bc654d54dd812aa2f8b4e.exe Sample

modified 2026-10-16 20:28:18
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

autoconfig.de Hostname

modified 2026-10-16 16:38:59
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

prod.tools Hostname

modified 2026-10-16 16:35:48
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.host Hostname

modified 2026-10-16 16:35:44
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.de Hostname

modified 2026-10-16 12:40:04
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webdisk.de Hostname

modified 2026-10-16 12:38:10
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.cn Hostname

modified 2026-10-16 12:35:51
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webdisk.us Hostname

modified 2026-10-16 12:34:33
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

mail.blog Hostname

modified 2026-10-16 09:57:05
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

secure.dev Hostname

modified 2026-10-16 08:39:31
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.es Hostname

modified 2026-10-16 06:37:47
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.online Hostname

modified 2026-10-16 04:41:13
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.secure Hostname

modified 2026-10-16 03:38:52
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

dae5b892f3d198db535ea850f21d0b659c9b17a071cd8b7bd7e8c352e3911087 Sample

modified 2026-10-14 16:16:53
Turla (Cyber Threat Alliance)

c6f1f233bb03600c82bb2f8ce30ee85f239992178a8f0c19aec1c26c0c0437c2 Sample

modified 2026-10-13 04:09:35
Turla (Cyber Threat Alliance)

050e1309129917b72d41949eaf5308914fb20d4e039920652b18899438b9f363 Sample

modified 2026-10-12 17:40:36
Turla (Cyber Threat Alliance)

ZiraatBankasi-20211118.exe Sample

modified 2026-10-12 04:40:27
SnakeKeylogger (Abuse.ch) · Generic.Malware (Abuse.ch) · Snake (ThreatFox Abuse.ch)

test.secure Hostname

modified 2026-10-11 06:55:19
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

db84de7037843fe1a69d88d83c265790e713ba2ea650ff73d4c57f64278b55de Sample

modified 2026-10-10 16:04:54
Turla (Cyber Threat Alliance)

e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60 Sample

modified 2026-10-10 00:58:48
Generic Malware (Hybrid-Analysis) · Snake (MalwareBazaar Abuse.ch) · AV.Generic (Hybrid-Analysis)

autoconfig.health Hostname

modified 2026-10-09 11:50:19
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

tmp0b35yukd Sample

modified 2026-10-09 03:18:10
Generic Malware (Hybrid-Analysis) · Backdoor.Turla (Hybrid-Analysis)

Scan copy swift.exe Sample

modified 2026-10-08 07:36:08
Generic Malware (Hybrid-Analysis) · SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

Request for Quotation.exe Sample

modified 2026-10-07 23:48:45
DarkComet (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

SecuriteInfo.com.Win32.PWSX-gen.32566.31866 Sample

modified 2026-10-07 14:25:55
Generic Malware (Hybrid-Analysis) · SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

1d1e234aa6f72397077d58d7be26f0f16ea97579fcc110e8fe401a47183b6225 Sample

modified 2026-10-07 08:21:20
Snake (ThreatFox Abuse.ch)

1ab39b59bd987548de3ae8715b9270a1c55dbee9c8a3a73a6a6bf7317d4f7075.exe Sample

modified 2026-10-06 23:01:47
SnakeKeylogger (MalwareBazaar Abuse.ch) · Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

autoconfig.info Hostname

modified 2026-10-06 11:47:57
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.wiki Hostname

modified 2026-10-04 13:02:48
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autoconfig.tickets Hostname

modified 2026-10-03 18:01:56
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

AWB & Invoice.pdf.gz Sample

modified 2026-10-03 17:18:40
SnakeKeylogger (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

Microsoft Office Information.doc.rtf Sample

modified 2026-09-30 20:19:19
Spyware (VM-Ray) · Keylogger (VM-Ray) · Downloader (VM-Ray) · Exploit (VM-Ray) · Snake (ThreatFox Abuse.ch)

0a150814a392799c9c416674a8cbf62b3852f8e5af611f83e9656a269c275194 Sample

modified 2026-09-30 18:21:01
Snake (ThreatFox Abuse.ch)

autoconfig.secure Hostname

modified 2026-09-30 16:33:23
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webdisk.media Hostname

modified 2026-09-30 09:27:17
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

autodiscover.shop Hostname

modified 2026-09-30 04:35:42
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940 Sample

modified 2026-09-29 07:25:55
SnakeKeylogger (MalwareBazaar Abuse.ch) · Spyware (VM-Ray) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

autoconfig.link Hostname

modified 2026-09-28 15:09:07
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

194c7d681f8c905c6f89414ebf06a71f851e38b391bad73902aa4b4e73806a4c Sample

modified 2026-09-27 11:11:59
Snake (ThreatFox Abuse.ch)

23a6dc4cce379f0d6a85e0b2b09e66d0d0f370e9d610a84aa1810aab605a3976 Sample

modified 2026-09-27 11:11:59
Snake (ThreatFox Abuse.ch)

227233773718879,XlSX.exe Sample

modified 2026-09-26 17:51:50
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

autoconfig.help Hostname

modified 2026-09-26 17:29:26
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

25a0a3eaa4354133700aad4f1ff07de47f52e2d4db43524b6c180c9694111c31 Sample

modified 2026-09-24 16:59:40
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

085046ececcff959420164dc9ff1f78b7d05abf01d4fe00e35933cf98a0698e5.exe Sample

modified 2026-09-24 16:44:10
Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

webdisk.directory Hostname

modified 2026-09-24 16:19:39
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

19ee645f892375a3de23462f42581ccc7968e31d8bcd064bb481188ccc236458.exe Sample

modified 2026-09-24 11:56:17
Spyware (VM-Ray) · Keylogger (VM-Ray) · Injector (VM-Ray) · Snake (ThreatFox Abuse.ch)

HALKBANK.exe Sample

modified 2026-09-24 08:30:08
SnakeKeylogger (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

ff267549b8f842b37cdbfbfa8bda58e4569235b78175c1aa1e8944658da7f50d.exe Sample

modified 2026-09-24 06:47:10
Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

211bbf7b08bd07a5c74d049e67d35a428497a8a30b180d8172cd9a74f8278887.exe Sample

modified 2026-09-24 04:04:12
Generic Malware (Hybrid-Analysis) · Spyware (VM-Ray) · Backdoor (VM-Ray) · Snake (ThreatFox Abuse.ch)

mail.tw Hostname

modified 2026-09-24 01:52:52
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

tmp3dx613lj Sample

modified 2026-09-23 19:29:31
Backdoor.Turla (Hybrid-Analysis)

autoconfig.forum Hostname

modified 2026-09-23 06:31:04
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

bro.exe Sample

modified 2026-09-23 02:21:15
Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

webdisk.search Hostname

modified 2026-09-23 01:22:42
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

19ced3f729d628d8b5b44c4f5c508349ece2cf5a730ea8ea893f931b5325b336 Sample

modified 2026-09-22 23:13:06
Snake (ThreatFox Abuse.ch)

RFQABCO004806L____________________pdf.exe Sample

modified 2026-09-22 23:13:05
Generic Malware (Hybrid-Analysis) · SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

2265e43c3f91487219234a3fda76b7077a1a70c6ee3b4672a7281faf06475542 Sample

modified 2026-09-21 23:17:33
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

1e579b1eece2934109a27d9ffd4799164a371e815be7b7637109d0613c91c4dd.exe Sample

modified 2026-09-20 12:22:59
Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d Sample

modified 2026-09-20 08:45:07
Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis) · Snake (ThreatFox Abuse.ch)

Yjntdre.exe Sample

modified 2026-09-19 21:30:30
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

autoconfig.radio Hostname

modified 2026-09-19 05:18:53
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webdisk.support Hostname

modified 2026-09-18 18:28:48
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

codewizard.ml Hostname

modified 2026-09-18 06:59:45
Turla (Maltiverse) · OilRig (Maltiverse)

fe0aefceacd7ecd1cd23ea39b1e7155c1222fb86ca09b891b72daf666e026fe8 Sample

modified 2026-09-17 06:25:08
Snake (ThreatFox Abuse.ch)

f98b8c6be528239e0ebe3622dadb5157e823089ab9b6b24b64a6282de1e9f38e Sample

modified 2026-09-17 03:25:52
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

fddb5.Trojan.exe Sample

modified 2026-09-17 00:59:17
SnakeKeylogger (MalwareBazaar Abuse.ch) · Spyware (VM-Ray) · Backdoor (VM-Ray) · Generic Malware (Hybrid-Analysis) · Snake (ThreatFox Abuse.ch)

hareketleriniz pdf.exe Sample

modified 2026-09-16 09:57:44
Spyware (VM-Ray) · DarkComet (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

fb32ee963d4a3a9ee628b7953fd14fb98fe1257946ce05c6e922005d05cdac74 Sample

modified 2026-09-16 08:45:05
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

doc2022031001001.pdf.exe Sample

modified 2026-09-15 17:54:15
SnakeKeylogger (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

autodiscover.business Hostname

modified 2026-09-15 12:50:32
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

webmail.forum Hostname

modified 2026-09-15 09:14:01
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

swift copy.exe Sample

modified 2026-09-15 06:30:37
AsyncRAT (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

autoconfig.media Hostname

modified 2026-09-14 14:51:29
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

fc00bf8337b313d331cc6fa9be8faff6fc1fa60b5f34cd34604614b52e637fd9 Sample

modified 2026-09-14 10:22:30
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

DHL DOC 7465389.pdf.xz Sample

modified 2026-09-13 19:28:18
SnakeKeylogger (MalwareBazaar Abuse.ch) · Snake (ThreatFox Abuse.ch)

0f949e601f3c97fb3ad927c128fd3654.exe Sample

modified 2026-09-11 05:18:42
Generic.Malware (Abuse.ch) · RedLineStealer (Abuse.ch) · Snake (ThreatFox Abuse.ch)

452b278f614b59c5e8a9160f4c69c91f Sample

modified 2026-09-11 02:25:56
Generic.Malware (Abuse.ch) · Snake (ThreatFox Abuse.ch)

Quote 2021.pdf.exe Sample

modified 2026-09-11 02:25:37
SnakeKeylogger (Abuse.ch) · Generic.Malware (Abuse.ch) · Snake (ThreatFox Abuse.ch)

040a3d53daba1ccab511032ac29845f3.exe Sample

modified 2026-09-11 02:25:17
SnakeKeylogger (Abuse.ch) · Snake (ThreatFox Abuse.ch)

16d2d4df7930ae194a64eed0b788a4a6.exe Sample

modified 2026-09-11 02:25:17
AgentTesla (Abuse.ch) · Snake (ThreatFox Abuse.ch)

Details.exe Sample

modified 2026-09-11 02:25:00
AgentTesla (Abuse.ch) · Snake (ThreatFox Abuse.ch)

INVOICE -PAYMENT PROCESS-PDF.exe Sample

modified 2026-09-11 02:24:55
AgentTesla (Abuse.ch) · Snake (ThreatFox Abuse.ch)

Musterino_96123931_Ekno_1_20215124531_ekstre.pdf.exe Sample

modified 2026-09-11 02:24:54
SnakeKeylogger (Abuse.ch) · Generic.Malware (Abuse.ch) · Snake (ThreatFox Abuse.ch)

Purchase Order.exe Sample

modified 2026-09-11 02:24:40
SnakeKeylogger (Abuse.ch) · Snake (ThreatFox Abuse.ch)

PO.exe Sample

modified 2026-09-11 02:24:30
SnakeKeylogger (Abuse.ch) · Snake (ThreatFox Abuse.ch)

ORDER_02_881_2021_PDF.exe Sample

modified 2026-09-11 02:24:30
SnakeKeylogger (Abuse.ch) · Snake (ThreatFox Abuse.ch)

Order_001-882-2021_pdf.exe Sample

modified 2026-09-11 02:24:30
SnakeKeylogger (Abuse.ch) · Snake (ThreatFox Abuse.ch)

STATEMENT OF ACCOUNT - SWIFT TRANSFER COPY.exe Sample

modified 2026-09-11 02:24:19
SnakeKeylogger (MalwareBazaar Abuse.ch) · Generic.Malware (Abuse.ch) · Snake (ThreatFox Abuse.ch)