Turla

G0010 Russia Espionage MITRE ATT&CK →

Also known as: IRON HUNTER · Group 88 · Waterbug · WhiteBear · Snake · Krypton · Venomous Bear · Secret Blizzard · BELUGASTURGEON

Overview

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Targets

Education · Energy · Government · Healthcare · Military · Private sector

Regions

Belarus · France · Germany · India · Iran · Iraq · Kazakhstan · Netherlands · Poland · Romania · Russia · Saudi Arabia · South Korea · Tajikistan · United Kingdom · United States · Uzbekistan

Capabilities

Custom malware/implant development — ATT&CK: 17 attributed custom malware families

TTPs — 68 techniques across 13 tactics

Resource Development

T1583.006 Web Services
T1584.003 Virtual Private Server
T1584.004 Server
T1584.006 Web Services
T1587.001 Malware
T1588.001 Malware
T1588.002 Tool

Initial Access

T1189 Drive-by Compromise
T1566.002 Spearphishing Link

Execution

T1059.001 PowerShell
T1059.003 Windows Command Shell
T1059.005 Visual Basic
T1059.006 Python
T1059.007 JavaScript
T1106 Native API
T1204.001 Malicious Link

Collection

Command and Control

T1071.001 Web Protocols
T1071.003 Mail Protocols
T1090 Proxy
T1090.001 Internal Proxy
T1102 Web Service
T1102.002 Bidirectional Communication
T1105 Ingress Tool Transfer

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Tools & malware (30)

PsExec · nbtstat · ComRAT · netstat · certutil · Empire · Mosquito · KOPILUWAK · IronNetInjector · LunarWeb · Arp · Crutch · Uroburos · PowerStallion · Gazer · Kazuar · Systeminfo · LightNeuron · Carbon · Mimikatz · Tasklist · LunarMail · Net · Reg · HyperStack · Epic · NBTscan · TinyTurla · Penquin · LunarLoader

Reporting (3)

How Microsoft names threat actors — Microsoft
Hunting Russian Intelligence “Snake” Malware — FBI et al
TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines — Cisco Talos

Overview

Targets

Regions

Capabilities

TTPs — 68 techniques across 13 tactics

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Tools & malware (30)

Reporting (3)