# Turla: threat group profile

> Turla is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 50 attack techniques, and to attacks on government and military organisations, with 15 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.edgeprotect.io/threat-actors/turla
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > Turla

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 50 (plus 41 sub-techniques) |
| Countries and victims named | 15 |
| Thought to operate from | Russia |
| Suspected backing | Russia |
| Motive | Espionage |
| Other names | 25 |
| Public reports | 36 |

## Who is Turla?

Turla is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 50 attack techniques, and to attacks on government and military organisations, with 15 countries and victims named.

### Also known as

Snake, VENOMOUS Bear, Group 88, Waterbug, WRAITH, Uroburos, Pfinet, TAG_0530, KRYPTON, Hippo Team, Pacifier APT, Popeye, SIG23, IRON HUNTER, MAKERSMARK, ATK13, G0010, ITG12, Blue Python, SUMMIT, UNC4210, Secret Blizzard, UAC-0144, UAC-0024, UAC-0003

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code. Cyrillic was also seen in use.'

## How does Turla attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 50 linked to Turla. Some techniques belong to more than one stage. Public reporting also lists 41 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (4)

- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1587: Develop Capabilities
- T1588: Obtain Capabilities

### 3. Getting in (3)

- T1078: Valid Accounts
- T1189: Drive-by Compromise
- T1566: Phishing

### 4. Running code (3)

- T1059: Command and Scripting Interpreter
- T1106: Native API
- T1204: User Execution

### 5. Staying in (4)

- T1078: Valid Accounts
- T1112: Modify Registry
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (6)

- T1055: Process Injection
- T1068: Exploitation for Privilege Escalation
- T1078: Valid Accounts
- T1134: Access Token Manipulation
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (7)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1055: Process Injection
- T1078: Valid Accounts
- T1134: Access Token Manipulation
- T1140: Deobfuscate/Decode Files or Information
- T1564: Hide Artifacts

### 8. Disabling defences (3)

- T1112: Modify Registry
- T1553: Subvert Trust Controls
- T1685: Disable or Modify Tools

### 9. Stealing passwords (2)

- T1110: Brute Force
- T1555: Credentials from Password Stores

### 10. Looking around (15)

- T1007: System Service Discovery
- T1012: Query Registry
- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1069: Permission Groups Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1120: Peripheral Device Discovery
- T1124: System Time Discovery
- T1201: Password Policy Discovery
- T1518: Software Discovery
- T1615: Group Policy Discovery

### 11. Spreading (2)

- T1021: Remote Services
- T1570: Lateral Tool Transfer

### 12. Gathering data (4)

- T1005: Data from Local System
- T1025: Data from Removable Media
- T1213: Data from Information Repositories
- T1560: Archive Collected Data

### 13. Keeping contact (4)

- T1071: Application Layer Protocol
- T1090: Proxy
- T1102: Web Service
- T1105: Ingress Tool Transfer

### 14. Taking data out (1)

- T1567: Exfiltration Over Web Service

### 15. Causing damage (0)

- None linked in public reporting.

## Who does Turla go after?

**Sectors:** Government, Military

**Countries and victims named:** France, Romania, Kazakhstan, Poland, Tajikistan, Russia, United States, Saudi Arabia, Germany, India, Belarus, Netherlands, Iran, Uzbekistan, Iraq

See threats by industry: https://www.edgeprotect.io/industries

## Public reports about Turla

- https://www.circl.lu/pub/tr-25/
- https://securelist.com/introducing-whitebear/81638/
- https://securelist.com/the-epic-turla-operation/65545/
- https://www.cfr.org/interactive/cyber-operations/turla
- https://www.nytimes.com/2010/08/26/technology/26cyber.html
- https://securelist.com/blog/research/67962/the-penquin-turla-2/
- https://www.kaspersky.com/blog/moonlight-maze-the-lessons/6713/
- https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf
- https://securelist.com/analysis/publications/65545/the-epic-turla-operation/
- https://threatpost.com/linux-modules-connected-to-turla-apt-discovered/109765/
- https://securelist.com/satellite-turla-apt-command-and-control-in-the-sky/72081/
- https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/
- https://www.first.org/resources/papers/tbilisi2014/turla-operations_and_development.pdf
- https://yle.fi/uutiset/osasto/news/russian_group_behind_2013_foreign_ministry_hack/8591548
- https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
- https://securelist.com/blog/research/72081/satellite-turla-apt-command-and-control-in-the-sky/
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/
- https://docs.broadcom.com/doc/waterbug-attack-group
- https://www.theguardian.com/technology/2014/aug/07/turla-hackers-spying-governments-researcher-kaspersky-symantec
- https://www.bleepingcomputer.com/news/security/turla-outlook-backdoor-uses-clever-tactics-for-stealth-and-persistence/
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
- https://www.melani.admin.ch/melani/en/home/dokumentation/reports/technical-reports/technical-report_apt_case_ruag.html
- https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/
- https://www.engadget.com/2017/06/07/russian-malware-hidden-britney-spears-instagram/
- https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
- https://www.trendmicro.com/vinfo/vn/security/news/cyber-attacks/cyberespionage-group-turla-deploys-backdoor-ahead-of-g20-summit
- https://www.zdnet.com/article/this-hacking-gang-just-updated-the-malware-it-uses-against-uk-targets/
- https://attack.mitre.org/groups/G0010/
- https://www.telsy.com/turla-venomous-bear-updates-its-arsenal-newpass-appears-on-the-apt-threat-scene/
- https://www.secureworks.com/research/threat-profiles/iron-hunter
- https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
- https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag
- https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
- https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
- https://cip.gov.ua/services/cm/api/attachment/download?id=60068

## Frequently asked questions

### Who is Turla?

Turla is an espionage group thought to operate from Russia, with suspected state backing. Public reporting links it to 50 attack techniques, and to attacks on government and military organisations, with 15 countries and victims named.

### Where is Turla thought to be based?

Public reporting places Turla as operating from Russia, with suspected state backing. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Turla target?

In public reporting, sectors named include government and military, and 15 countries and victims are named, including France, Romania, Kazakhstan and Poland.

### How does Turla attack?

Public reporting links Turla to 50 attack techniques. Most of them are about looking around, hiding and taking control.

### How do I know if Turla is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact