Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.
- ATT&CK ID
- G0010
- Origin
- Russia
- Weather family
- Blizzard
- Techniques
- 50
- Tools
- 30
Also tracked as IRON HUNTER · Group 88 · Waterbug · WhiteBear · Snake · Krypton · Venomous Bear · Secret Blizzard · BELUGASTURGEON
In the news
- AI Makes Reverse Engineering Mainstream Software & Malware Far EasierDark Reading · 2026-11-10
- Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange ServersThe Hacker News · 2026-11-10
Techniques
Resource Development
Acquire InfrastructureCompromise InfrastructureDevelop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsDrive-by CompromisePhishing
Execution
Command and Scripting InterpreterNative APIUser Execution
Persistence
Valid AccountsModify RegistryEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Process InjectionExploitation for Privilege EscalationValid AccountsAccess Token ManipulationEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionValid AccountsAccess Token ManipulationDeobfuscate/Decode Files or InformationHide Artifacts
Defense Impairment
Modify RegistrySubvert Trust ControlsDisable or Modify Tools
Credential Access
Brute ForceCredentials from Password Stores
Discovery
System Service DiscoveryQuery RegistrySystem Network Configuration DiscoveryRemote System DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoveryPeripheral Device DiscoverySystem Time DiscoveryPassword Policy DiscoverySoftware DiscoveryGroup Policy Discovery
Lateral Movement
Remote ServicesLateral Tool Transfer
Collection
Data from Local SystemData from Removable MediaData from Information RepositoriesArchive Collected Data
Command and Control
Application Layer ProtocolProxyWeb ServiceIngress Tool Transfer
Exfiltration
Software
Arp · Carbon · ComRAT · Crutch · Empire · Epic · Gazer · HyperStack · IronNetInjector · KOPILUWAK · Kazuar · LightNeuron · LunarLoader · LunarMail · LunarWeb · Mimikatz · Mosquito · NBTscan · Net · Penquin · PowerStallion · PsExec · Reg · Systeminfo · Tasklist · TinyTurla · Uroburos · certutil · nbtstat · netstat