ATT&CKGroupsTurla

Turla

G0010

Threat group.View on attack.mitre.org

About this group

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Techniques used68

Resource Development7

T1583.006Web ServicesT1584.003Virtual Private ServerT1584.004ServerT1584.006Web ServicesT1587.001MalwareT1588.001MalwareT1588.002Tool

Initial Access3

T1078.003Local AccountsT1189Drive-by CompromiseT1566.002Spearphishing Link

Execution7

T1059.001PowerShellT1059.003Windows Command ShellT1059.005Visual BasicT1059.006PythonT1059.007JavaScriptT1106Native APIT1204.001Malicious Link

Persistence6

T1078.003Local AccountsT1112Modify RegistryT1546.003Windows Management Instrumentation Event SubscriptionT1546.013PowerShell ProfileT1547.001Registry Run Keys / Startup FolderT1547.004Winlogon Helper DLL

Privilege Escalation9

T1055Process InjectionT1055.001Dynamic-link Library InjectionT1068Exploitation for Privilege EscalationT1078.003Local AccountsT1134.002Create Process with TokenT1546.003Windows Management Instrumentation Event SubscriptionT1546.013PowerShell ProfileT1547.001Registry Run Keys / Startup FolderT1547.004Winlogon Helper DLL

Stealth10

T1027.005Indicator Removal from ToolsT1027.010Command ObfuscationT1027.011Fileless StorageT1036.005Match Legitimate Resource Name or LocationT1055Process InjectionT1055.001Dynamic-link Library InjectionT1078.003Local AccountsT1134.002Create Process with TokenT1140Deobfuscate/Decode Files or InformationT1564.012File/Path Exclusions

Defense Impairment3

T1112Modify RegistryT1553.006Code Signing Policy ModificationT1685Disable or Modify Tools

Credential Access2

T1110Brute ForceT1555.004Windows Credential Manager

Discovery18

T1007System Service DiscoveryT1012Query RegistryT1016System Network Configuration DiscoveryT1016.001Internet Connection DiscoveryT1018Remote System DiscoveryT1049System Network Connections DiscoveryT1057Process DiscoveryT1069.001Local GroupsT1069.002Domain GroupsT1082System Information DiscoveryT1083File and Directory DiscoveryT1087.001Local AccountT1087.002Domain AccountT1120Peripheral Device DiscoveryT1124System Time DiscoveryT1201Password Policy DiscoveryT1518.001Security Software DiscoveryT1615Group Policy Discovery

Lateral Movement2

T1021.002SMB/Windows Admin SharesT1570Lateral Tool Transfer

Collection4

T1005Data from Local SystemT1025Data from Removable MediaT1213.006DatabasesT1560.001Archive via Utility

Command and Control7

T1071.001Web ProtocolsT1071.003Mail ProtocolsT1090ProxyT1090.001Internal ProxyT1102Web ServiceT1102.002Bidirectional CommunicationT1105Ingress Tool Transfer

Exfiltration1

T1567.002Exfiltration to Cloud Storage

Procedure examples68

TechniqueProcedure example
T1005
Data from Local System

Turla RPC backdoors can upload files from victim machines.

ESET Turla PowerShell May 2019
T1007
System Service Discovery

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

Kaspersky Turla
T1012
Query Registry

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

ESET Turla PowerShell May 2019Kaspersky Turla
T1016
System Network Configuration Discovery

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

ESET ComRAT May 2020ESET Turla PowerShell May 2019Kaspersky TurlaSymantec Waterbug Jun 2019
T1016.001
Internet Connection Discovery

Turla has used tracert to check internet connectivity.

ESET ComRAT May 2020
T1018
Remote System Discovery

Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.

ESET ComRAT May 2020Kaspersky Turla
T1021.002
SMB/Windows Admin Shares

Turla used net use commands to connect to lateral systems within a network.

Kaspersky Turla
T1025
Data from Removable Media

Turla RPC backdoors can collect files from USB thumb drives.

ESET Turla PowerShell May 2019Symantec Waterbug Jun 2019
T1027.005
Indicator Removal from Tools

Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.

ESET Gazer Aug 2017
T1027.010
Command Obfuscation

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

ESET Turla PowerShell May 2019
T1027.011
Fileless Storage

Turla has used the Registry to store encrypted and encoded payloads.

ESET Turla PowerShell May 2019Symantec Waterbug Jun 2019
T1036.005
Match Legitimate Resource Name or Location

Turla has named components of LunarWeb to mimic Zabbix agent logs.

ESET Turla Lunar toolset May 2024
T1049
System Network Connections Discovery

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

ESET ComRAT May 2020ESET Turla PowerShell May 2019Kaspersky Turla
T1055
Process Injection

Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.

ESET Turla PowerShell May 2019
T1055.001
Dynamic-link Library Injection

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.

ESET Turla Mosquito May 2018Github Rapid7 Meterpreter Elevate

View all 68 procedure examples

Software30

ArpCarboncertutilComRATCrutchEmpireEpicGazerHyperStackIronNetInjectorKazuarKOPILUWAKLightNeuronLunarLoaderLunarMailLunarWebMimikatzMosquitoNBTscannbtstatNetnetstatPenquinPowerStallion
Show 6 more
PsExecRegSysteminfoTasklistTinyTurlaUroburos

Campaigns0

None recorded.

References5

  1. CrowdStrike VENOMOUS BEAR Open source
    Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018.
  2. ESET Gazer Aug 2017 Open source
    ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
  3. ESET Turla Mosquito Jan 2018 Open source
    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  4. Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 Open source
    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  5. Kaspersky Turla Open source
    Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn