MITRE ATT&CKgroup

G0010 Turla

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON
Version
5.1
Created
2017-05-31

Description

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Related

Uses · MITRE ATT&CK (98)

  • T1685 Disable or Modify Tools technique
  • T1213.006 Databases sub-technique
  • S1143 LunarLoader software (malware)
  • S1141 LunarWeb software (malware)
  • S1142 LunarMail software (malware)
  • T1564.012 File/Path Exclusions sub-technique
  • S1075 KOPILUWAK software (malware)
  • T1027.011 Fileless Storage sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • S0668 TinyTurla software (malware)
  • T1615 Group Policy Discovery technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • S0590 NBTscan software (tool)
  • T1016.001 Internet Connection Discovery sub-technique
  • S0587 Penquin software (malware)
  • S0581 IronNetInjector software (tool)
  • S0538 Crutch software (malware)
  • S0537 HyperStack software (malware)
  • T1555.004 Windows Credential Manager sub-technique
  • T1583.006 Web Services sub-technique
  • T1584.003 Virtual Private Server sub-technique
  • T1584.004 Server sub-technique
  • T1584.006 Web Services sub-technique
  • T1587.001 Malware sub-technique
  • T1588.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1059.007 JavaScript sub-technique
  • T1027.005 Indicator Removal from Tools sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 98 ›

References