G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
Security context for executives and security teams
G0010: Turla describes [Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos...
Executive priority
G0010: Turla is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G0010: Turla by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G0010: Turla appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1584.006 | Web ServicesSub-technique | Turla has frequently used compromised WordPress sites for C2 infrastructure.CitationRecorded Future Turla Infra 2020 |
| Enterprise | T1112 | Modify Registry | |
| Enterprise | T1069.001 | Local GroupsSub-technique | Turla has used |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.[6] |
| Enterprise | T1588.002 | ToolSub-technique | |
| Enterprise | T1059.007 | JavaScriptSub-technique | |
| Enterprise | T1134.002 | Create Process with TokenSub-technique | |
| Enterprise | T1059.005 | Visual BasicSub-technique | Turla has used VBS scripts throughout its operations.CitationSymantec Waterbug Jun 2019 |
| Enterprise | T1546.013 | PowerShell ProfileSub-technique | |
| Enterprise | T1583.006 | Web ServicesSub-technique | Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.CitationESET Crutch December 2020 |
| Enterprise | T1055.001 | Dynamic-link Library InjectionSub-technique | Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.CitationESET Turla Mosquito May 2018CitationGithub Rapid7 Meterpreter Elevate |
| Enterprise | T1105 | Ingress Tool Transfer | Turla has used shellcode to download Meterpreter after compromising a victim.CitationESET Turla Mosquito May 2018 |
| Enterprise | T1555.004 | Windows Credential ManagerSub-technique | Turla has gathered credentials from the Windows Credential Manager tool.CitationSymantec Waterbug Jun 2019 |
| Enterprise | T1090 | Proxy | |
| Enterprise | T1068 | Exploitation for Privilege Escalation | Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.CitationUnit42 AcidBox June 2020 |
| Enterprise | T1615 | Group Policy Discovery | Turla surveys a system upon check-in to discover Group Policy details using the |
| Enterprise | T1049 | System Network Connections Discovery | |
| Enterprise | T1106 | Native API | |
| Enterprise | T1071.003 | Mail ProtocolsSub-technique | Turla has used multiple backdoors which communicate with a C2 server via email attachments.CitationCrowdstrike GTR2020 Mar 2020 |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | A Turla Javascript backdoor added a local_update_check value under the Registry key |
| Enterprise | T1005 | Data from Local System | |
| Enterprise | T1012 | Query Registry | |
| Enterprise | T1007 | System Service Discovery | |
| Enterprise | T1110 | Brute Force | |
| Enterprise | T1570 | Lateral Tool Transfer | |
| Enterprise | T1189 | Drive-by Compromise | |
| Enterprise | T1584.004 | ServerSub-technique | |
| Enterprise | T1087.002 | Domain AccountSub-technique | Turla has used |
| Enterprise | T1685 | Disable or Modify Tools | |
| Enterprise | T1564.012 | File/Path ExclusionsSub-technique | |
| Enterprise | T1120 | Peripheral Device Discovery | Turla has used |
| Enterprise | T1567.002 | Exfiltration to Cloud StorageSub-technique | |
| Enterprise | T1102.002 | Bidirectional CommunicationSub-technique | |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | |
| Enterprise | T1124 | System Time Discovery | |
| Enterprise | T1087.001 | Local AccountSub-technique | Turla has used |
| Enterprise | T1204.001 | Malicious LinkSub-technique | |
| Enterprise | T1090.001 | Internal ProxySub-technique | |
| Enterprise | T1546.003 | Windows Management Instrumentation Event SubscriptionSub-technique | |
| Enterprise | T1560.001 | Archive via UtilitySub-technique | Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.CitationSymantec Waterbug Jun 2019 |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | |
| Enterprise | T1057 | Process Discovery | |
| Enterprise | T1016 | System Network Configuration Discovery | Turla surveys a system upon check-in to discover network configuration details using the |
| Enterprise | T1587.001 | MalwareSub-technique | Turla has developed its own unique malware for use in operations.CitationRecorded Future Turla Infra 2020 |
| Enterprise | T1025 | Data from Removable Media | |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.CitationESET ComRAT May 2020 |
| Enterprise | T1059.001 | PowerShellSub-technique | |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | Turla has used encryption (including salted 3DES via PowerSploit's |
| Enterprise | T1059.006 | PythonSub-technique | Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.CitationUnit 42 IronNetInjector February 2021 |
| Enterprise | T1213.006 | DatabasesSub-technique | Turla has used a custom .NET tool to collect documents from an organization's internal central database.CitationESET ComRAT May 2020 |
| Enterprise | T1018 | Remote System Discovery | Turla surveys a system upon check-in to discover remote systems on a local network using the |
| Enterprise | T1588.001 | MalwareSub-technique | |
| Enterprise | T1069.002 | Domain GroupsSub-technique | Turla has used |
| Enterprise | T1027.011 | Fileless StorageSub-technique | |
| Enterprise | T1547.004 | Winlogon Helper DLLSub-technique |
Groups, software, and campaigns
S0029: PsExec
S0102: nbtstat
S0126: ComRAT
S0104: netstat
S0160: certutil
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
S0256: Mosquito
S1075: KOPILUWAK
S0581: IronNetInjector
IronNetInjector is a Turla toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including ComRAT.[1]
S1141: LunarWeb
LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.[1]
S0099: Arp
S0538: Crutch
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 5.1 | Current bundle | 4e440e5e5bb0… | ||
| 19.1 | 5.1 | Older bundle | b67d6f0bd028… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Kaspersky Turla
Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
Open source URL - [2]ESET Gazer Aug 2017
ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
Open source URL - [3]CrowdStrike VENOMOUS BEAR
Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018.
Open source URL - [4]ESET Turla Mosquito Jan 2018
ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
Open source URL - [5]Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
Open source URL - [6]ESET Turla PowerShell May 2019
Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
Open source URL - [7]Symantec Waterbug
Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.
Open source URL - [8]Secureworks IRON HUNTER Profile
Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.
- [9]Accenture HyperStack October 2020
Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.
Open source URL - [10]Talos TinyTurla September 2021
Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.
Open source URL - [11]BELUGASTURGEON
(Citation: Accenture HyperStack October 2020)
- [12]Group 88
(Citation: Leonardo Turla Penquin May 2020)
- [13]IRON HUNTER
(Citation: Secureworks IRON HUNTER Profile)
- [14]Krypton
(Citation: CrowdStrike VENOMOUS BEAR)
- [15]Leonardo Turla Penquin May 2020
Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.
Open source URL - [16]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [17]Secret Blizzard
(Citation: Microsoft Threat Actor Naming July 2023)
- [18]Securelist WhiteBear Aug 2017
Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
Open source URL - [19]Snake
(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla PowerShell May 2019)(Citation: Talos TinyTurla September 2021)
- [20]Turla
(Citation: Kaspersky Turla)
- [21]Venomous Bear
(Citation: CrowdStrike VENOMOUS BEAR)(Citation: Talos TinyTurla September 2021)
- [22]Waterbug
Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.(Citation: Symantec Waterbug)
- [23]WhiteBear
WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.(Citation: Securelist WhiteBear Aug 2017)(Citation: Talos TinyTurla September 2021)
- [24]mitre-attackG0010Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.