Turla

MITRE ATT&CK: G0010 View on attack.mitre.org

Aliases: IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON, VENOMOUS Bear, WRAITH, Uroburos, Pfinet, TAG_0530, KRYPTON, Hippo Team, Pacifier APT, Popeye, SIG23, MAKERSMARK, ATK13, ITG12, Blue Python, SUMMIT, UNC4210, UAC-0144, UAC-0024, UAC-0003, Turla, ATG26

First seen
2004-01-01 00:00:00
Origin
RU
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Espionage
Related IoCs
501 (474 malicious)
Last IoC activity
2026-10-17 03:31:57
Profile updated
2026-07-07 12:34:09

Targeted industries: government-and-public-sector defense-and-aerospace education-and-nonprofits healthcare-and-pharmaceutical

Context

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Recent IoC activity

474 malicious indicators in Maltiverse are attributed to Turla (G0010). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname test.support 2026-10-17 1
hostname ns-3.open.ro 2026-10-17 1
hostname autoconfig.host 2026-10-17 1
hostname microsoft.updatemeltdownkb7234.com 2026-10-17 2
hostname autoconfig.email 2026-10-17 1
hostname mail.news 2026-10-17 1
hostname autodiscover.store 2026-10-17 1
hostname ns-2.open.ro 2026-10-16 1
hostname made.by 2026-10-16 1
hostname admin.dev 2026-10-16 1
hostname autodiscover.it 2026-10-16 1
hostname webdisk.cn 2026-10-16 1
file sample 0f452d8cab2cdea13fea10ac2d80618f82439412e5bac82c431e1ea2f15c621d 2026-10-16 2
hostname autoconfig.de 2026-10-16 1
hostname prod.tools 2026-10-16 1
hostname autodiscover.host 2026-10-16 1
hostname autodiscover.de 2026-10-16 1
hostname webdisk.de 2026-10-16 1
hostname autodiscover.cn 2026-10-16 2
hostname webdisk.us 2026-10-16 1

Detection coverage

  • 34 YARA rules
  • 966 Sigma rules

Malware & tools used

  • Modify Registry (attack-pattern)
  • Local Groups (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Tool (attack-pattern)
  • JavaScript (attack-pattern)
  • Create Process with Token (attack-pattern)
  • Visual Basic (attack-pattern)
  • PowerShell Profile (attack-pattern)
  • Web Services (attack-pattern)
  • Dynamic-link Library Injection (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Windows Credential Manager (attack-pattern)
  • Proxy (attack-pattern)
  • Exploitation for Privilege Escalation (attack-pattern)
  • Group Policy Discovery (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Mail Protocols (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Data from Local System (attack-pattern)
  • Query Registry (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Brute Force (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)

Related threat objects

Reports & references

  • secureworks.com — Iron Hunter (report)
  • Cisco Talos — Tinyturla (report)
  • web.archive.org — Turla Belugasturgeon Compromises Government Entity (report)
  • CISA — Aa23 129A Snake Malware 2 (report)
  • CrowdStrike — Meet Crowdstrikes Adversary Of The Month For March Venomous Bear (report)
  • leonardo.com — Malware+Technical+Insight+ Turla+%E2%80%9Cpenquin X64%E2%80%9D (report)
  • threatminer.org — Report (report)
  • ESET — Turla Powershell Usage (report)
  • ESET — Eset Turla Mosquito (report)
  • blog.google — Continued Cyber Activity In Eastern Europe Observed By Tag (report)
  • blog.google — Fog Of War How The Ukraine Conflict Transformed The Cyber Threat Landscape (report)
  • cip.gov.ua — Download (report)
  • circl.lu — Tr 25 (report)
  • Kaspersky — 81638 (report)
  • Kaspersky — 65545 (report)
  • cfr.org — Turla (report)
  • nytimes.com — 26Cyber (report)
  • Kaspersky — The Penquin Turla 2 (report)
  • kaspersky.com — 6713 (report)
  • Mandiant — Rpt Witchcoven (report)
  • Kaspersky — The Epic Turla Operation (report)
  • threatpost.com — 109765 (report)
  • Kaspersky — 72081 (report)
  • ESET — Turla Mosquito Shift Towards Generic Tools (report)
  • first.org — Turla Operations And Development (report)

Attributed from

  • C0026 (campaign)

External references