- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- State-sponsored, FSB Centre 16L: Radio-Electronic Intelligence on Communications Facilities, Post Number 71330
- Agency named
- FSB
- Motivation
- Espionage; Information theft and espionage
- Seen
- 1996–2026
- Status
- Active
- ATT&CK
- G0010 · 68 techniques
- Sources
- 16 sources carry it
- Identifier
- GINC-APT-0003 · turla
RussiaWhat it is
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0003, UAC-0024, UAC-0144
- CrowdStrike
- Boulder Bear, White Bear, Turla, Waterbug, Venomous Bear, Venomous Bear
- IBM X-Force
- ITG12
- Mandiant
- UNC4210
- Microsoft
- Secret Blizzard
- MITRE ATT&CK
- G0010
- NSA leak
- SIG15, SIG2, SIG23
- PwC
- Blue Python, White Atlas
- Qihoo 360
- APT-C-29
- Recorded Future
- TAG-0530
- Secureworks
- CTG-8875, IRON HUNTER
- Talos and others
- Group 88, Group88
- Thales
- ATK13
- Operations
- Operation “Epic Turla”, Operation “Moonlight Maze”, Operation “Penguin Turla”, Operation “Satellite Turla”, Operation “Skipper Turla”, Operation “Turla Mosquito”, Operation “WITCHCOVEN”
- Other names
- ATG26, ATK 13, BELUGASTURGEON, Hippo Team, Iron Pioneer, Krypton, Makersmark, Minime, Pacifier APT, Pensive Ursa, Pfinet, Popeye, Skipper Turla, Snake, SUMMIT, TAG_0530, Turla - APT-C-29, Turla Group, TURLA RELIC, Turla Team, Turla, Waterbug, Venomous Bear, Group 88, Uroburos, Waterbug, WhiteBear, Witchcoven, Wraith, Турла
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Chinese and Russian sources
- Qihoo 360Russia
Targets
- Countries
- Afghanistan, Algeria, Armenia, Australia, Austria, Azerbaijan, Belarus, Belgium, Bolivia, Botswana, Brazil, Chile, China, Denmark, Ecuador, Estonia, Finland, France, Georgia, Germany, Hong Kong, Hungary, India, Indonesia, Iran, Iraq, Italy, Jamaica, Jordan, Kazakhstan, Kuwait, Kyrgyzstan, Latvia, Mexico, Netherlands, Pakistan, Paraguay, Poland, Qatar, Romania, Russia, Saudi Arabia, Serbia, South Africa, South Korea, Spain, Sweden, Switzerland, Syria, Tajikistan, Thailand, Tunisia, Turkmenistan, Ukraine, United Kingdom, United States, Uruguay, Uzbekistan, Venezuela, Vietnam, Yemen
- Sectors
- Aerospace, Defense, Education, Electric, Embassies, Energy, Government, Government, Administration, Health, High-Tech, IT, Media, Military, NGOs, Pharmaceutical, Private sector, Research, Retail
Tools
The first 60 of 108 tools and malware families the sources tie to it.
- ASPXSpy
- ATI-Agent
- AdobeARM
- Agent.BTZ
- Agent.dne
- ApolloShadow
- Archelaus Beta
- Arp
- COMpfun
- Carbon
- China Chopper
- CloudDuke
- Cobra Carbon System
- ComLook
- ComRAT
- CrossRat
- Crutch
- CyberAzov
- DeliveryCheck
- DoublePulsar
- Empire
- EmpireProject
- Epic
- EternalBlue
- EternalRomance
- Gazer
- HTML5 Encoding
- HyperStack
- IcedCoffee
- IronNetInjector
- KOPILUWAK
- KSL0T
- Kazuar
- KopiLuwak
- LightNeuron
- Living off the Land
- LunarLoader
- LunarMail
- LunarWeb
- Maintools.js
- Metasploit
- Meterpreter
- MiamiBeach
- Mimikatz
- MiniDionis
- MiniJS
- MiniPocket
- Mosquito
- NBTscan
- NETVulture
- Nautilus
- Neptun
- Net
- NetFlash
- Neuron
- NewPass
- Outlook Backdoor
- POWERSOURCE
- POWERSTATS
- Pelmeni
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net