LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0091: Epic

Epic is a backdoor that has been used by Turla. [1]

EnterpriseS0091MalwareObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Epic is a Windows backdoor documented by ATT&CK as used by Turla. Its decision value is not just the malware name: the related behaviors show a toolset that can profile a host and network, look for users, services, accounts, security tools, files, storage, and connections, then use stealth, web-based command-and-control, encryption, archiving, and file deletion. For leaders, this makes Epic relevant to readiness questions: can the organization prove it can detect suspicious discovery and C2 activity on Windows endpoints before an intrusion becomes broader incident response work?

Executive priority

Treat this as a coverage-validation item for high-consequence Windows environments, especially where espionage-style intrusions would affect business continuity, sensitive data, regulated evidence, or operational resilience. Because ATT&CK provides no official detection text for Epic, priority should be placed on validating telemetry and controls against the related techniques rather than assuming malware-name detection is sufficient. Ask whether endpoint, network, identity, and incident response teams can reconstruct discovery, security-tool enumeration, collection preparation, and web-protocol C2 from retained evidence.

Technical view

SOC and detection teams should map Epic-related coverage to the supplied ATT&CK relationships: Windows registry queries, service/process/user/account/group discovery, network configuration and remote-system discovery, file/directory/storage discovery, security software discovery, web-protocol C2, symmetric cryptography, obfuscation, file deletion, code signing abuse, Extra Window Memory Injection, and archive creation via libraries. Since the object is a Windows malware entry and official detection is not provided, validation should focus on behavior chains and host/network correlation rather than a single signature. IR teams should confirm they can timeline suspicious discovery commands or API activity, unexpected archive creation, deletion of staging artifacts, abnormal web traffic, and code/process anomalies on Windows systems.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows registry access/query events
  • Service, process, local user, and local group enumeration evidence
  • File system events for discovery, archive creation, and deletion
  • Endpoint security tool and sensor health/status telemetry

Detection direction

  • Build detections around clustered discovery behaviors rather than isolated administration commands, because many related techniques overlap with legitimate troubleshooting and inventory activity.
  • Tune for unusual combinations: security software discovery followed by obfuscated payload activity, archive creation, file deletion, or web-protocol external communications.
  • Validate Windows registry, service, process, account, group, network, file, and storage discovery visibility on endpoints where business impact would be high.
  • Correlate endpoint events with proxy/DNS/network metadata for web-protocol C2, especially where traffic patterns are inconsistent with the host role.
  • Review code-signing trust decisions; signed binaries should not be automatically treated as benign when behavior aligns with discovery, collection, or C2.

Mitigation priorities

  • Prioritize endpoint visibility and retention on Windows systems before relying on malware-specific detections.
  • Harden least-privilege access and local administrator membership to reduce the value of account and group discovery.
  • Restrict and monitor outbound web traffic from servers and sensitive workstations according to expected business need.
  • Maintain tamper-resistant security tooling and alert on attempts to discover or disable defensive products where telemetry supports it.
  • Use application control, code-signing policy review, and execution controls to reduce trust in unknown or unexpected binaries.
Additional notes and limits

The most useful defensive interpretation is relationship-driven: ATT&CK links Epic to a broad set of discovery techniques plus stealth, command-and-control, collection preparation, and defense-impairment behaviors. This supports a managed detection and incident response focus on behavior correlation and evidence completeness, not a claim that any single analytic will identify Epic by name.

ATT&CK lists Epic as a Windows backdoor used by Turla and provides one cited external reporting source, but no official detection guidance and no object-level tactics. The relationship context supplies technique associations, but local validation is required to determine whether those behaviors are visible, suspicious, or already covered in a specific environment. This summary does not assert current activity, customer exposure, or guaranteed detection.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Epic

Epic is a backdoor that has been used by Turla. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1012Query Registry

Epic uses the rem reg query command to obtain values from Registry keys.[1]

EnterpriseT1057Process Discovery

Epic uses the tasklist /v command to obtain a list of processes.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

Epic uses HTTP and HTTPS for C2 communications.[1][2]

EnterpriseT1033System Owner/User Discovery

Epic collects the user name from the victim’s machine.[2]

EnterpriseT1124System Time Discovery

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.[1]

EnterpriseT1083File and Directory Discovery

Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.[1][2]

EnterpriseT1070.004File DeletionSub-technique

Epic has a command to delete a file from the machine.[2]

EnterpriseT1082System Information Discovery

Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.[2]

EnterpriseT1049System Network Connections Discovery

Epic uses the net use, net session, and netstat commands to gather information on network connections.[1][2]

EnterpriseT1018Remote System Discovery

Epic uses the net view command on the victim’s machine.[1]

EnterpriseT1560.002Archive via LibrarySub-technique

Epic compresses the collected data with bzip2 before sending it to the C2 server.[2]

EnterpriseT1055.011Extra Window Memory InjectionSub-technique

Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.[3]

EnterpriseT1553.002Code SigningSub-technique

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.[1]

EnterpriseT1087.001Local AccountSub-technique

Epic gathers a list of all user accounts, privilege classes, and time of last logon.[2]

EnterpriseT1560Archive Collected Data

Epic encrypts collected data using a public key framework before sending it over the C2 channel.[1] Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.[2]

EnterpriseT1069.001Local GroupsSub-technique

Epic gathers information on local group names.[2]

EnterpriseT1573.001Symmetric CryptographySub-technique

Epic encrypts commands from the C2 server using a hardcoded key.[1]

EnterpriseT1016System Network Configuration Discovery

Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.[1]

EnterpriseT1007System Service Discovery

Epic uses the tasklist /svc command to list the services on the system.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.[1]

EnterpriseT1680Local Storage Discovery

Epic collects disk space information.[2]

EnterpriseT1027Obfuscated Files or Information

Epic heavily obfuscates its code to make analysis more difficult.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1560.002: Archive via LibraryEnterpriseuses · TechniqueT1055.011: Extra Window Memory InjectionEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
7760cd30b787c966...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundle7760cd30b787…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  2. [2]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  3. [3]
    ESET Recon Snake Nest

    Boutin, J. and Faou, M. (2018). Visiting the snake nest. Retrieved May 7, 2019.

    Open source URL
  4. [4]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  5. [5]
    Epic

    (Citation: Kaspersky Turla)

  6. [6]
    Epic

    (Citation: Kaspersky Turla)

  7. [7]
    Epic

    (Citation: Kaspersky Turla)

  8. [8]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  9. [9]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  10. [10]
    TadjMakhal

    (Citation: Kaspersky Turla)

  11. [11]
    TadjMakhal

    (Citation: Kaspersky Turla)

  12. [12]
    TadjMakhal

    (Citation: Kaspersky Turla)

  13. [13]
    Tavdig

    (Citation: Kaspersky Turla)

  14. [14]
    Tavdig

    (Citation: Kaspersky Turla)

  15. [15]
    Tavdig

    (Citation: Kaspersky Turla)

  16. [16]
    Wipbot

    (Citation: Kaspersky Turla)

  17. [17]
    Wipbot

    (Citation: Kaspersky Turla)

  18. [18]
    Wipbot

    (Citation: Kaspersky Turla)

  19. [19]
    WorldCupSec

    (Citation: Kaspersky Turla)

  20. [20]
    WorldCupSec

    (Citation: Kaspersky Turla)

  21. [21]
    WorldCupSec

    (Citation: Kaspersky Turla)

  22. [22]
    mitre-attackS0091
    Open source URL
  23. [23]
    mitre-attackS0091
    Open source URL
  24. [24]
    mitre-attackS0091
    Open source URL
  25. [25]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  26. [26]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  27. [27]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  28. [28]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  29. [29]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  30. [30]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  31. [31]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  32. [32]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  33. [33]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  34. [34]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  35. [35]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  36. [36]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  37. [37]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  38. [38]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  39. [39]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  40. [40]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  41. [41]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  42. [42]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  43. [43]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  44. [44]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  45. [45]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  46. [46]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  47. [47]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  48. [48]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  49. [49]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  50. [50]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  51. [51]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  52. [52]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  53. [53]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  54. [54]
    ESET Recon Snake Nest

    Boutin, J. and Faou, M. (2018). Visiting the snake nest. Retrieved May 7, 2019.

    Open source URL
  55. [55]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  56. [56]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  57. [57]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  58. [58]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  59. [59]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  60. [60]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  61. [61]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  62. [62]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  63. [63]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  64. [64]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  65. [65]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  66. [66]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  67. [67]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  68. [68]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  69. [69]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  70. [70]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  71. [71]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  72. [72]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  73. [73]
    Kaspersky Turla Aug 2014

    Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.

    Open source URL
  74. [74]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
  75. [75]
    Kaspersky Turla

    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use