Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Turla · Nation-state · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Turla

  • Snake
  • VENOMOUS Bear
  • Group 88
  • Waterbug
  • WRAITH
  • Uroburos
  • Pfinet
  • TAG_0530

state sponsor · Russian FederationMITRE G0010 ↗

Turla — ATT&CK roseTU

attack rose · 68 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2012-1723, CVE-2013-3346, CVE-2013-5065, CVE-2017-0261, CVE-2019-11510
  2. —1 mo agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said.

There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carrying out the attacks and Symantecs Gavin O’ Gorman told the Guardian a number of the hackers appeared to be using Russian names and language in their notes for their malicious code.

Observed targets (as stated by the sources)

15 countries · 7 sectors
FranceRomaniaKazakhstanPolandTajikistanRussiaUnited StatesSaudi ArabiaGermanyIndiaBelarusNetherlandsIranUzbekistanIraqAssessed origin: Russia

assessed origin · Russiaobserved targets · 15

countries · 15

  • France
  • Romania
  • Kazakhstan
  • Poland
  • Tajikistan
  • Russia
  • United States
  • Saudi Arabia
  • Germany
  • India
  • Belarus
  • Netherlands
  • Iran
  • Uzbekistan
  • Iraq

sectors · 7

  • Government
  • Military
  • Government, Administration
  • Education
  • Electric
  • Energy
  • Health

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

68 techniques · 13 of 15 tactics

  1. Resource development

    7 techniques

  2. Initial access

    2 techniques

  3. Execution

    7 techniques

  4. Persistence

    2 techniques

  5. Privilege escalation

    3 techniques

  6. Stealth

    10 techniques

  7. Defense impairment

    3 techniques

  8. Credential access

    2 techniques

  9. Discovery

    18 techniques

  10. Lateral movement

    2 techniques

  11. Collection

    4 techniques

  12. Command and control

    7 techniques

  13. Exfiltration

    1 technique

select a technique

Arsenal

17 malware · 13 tools
Malware
Malware · 17ATT&CK
ComRATS0126 ↗
MosquitoS0256 ↗
KOPILUWAKS1075 ↗
LunarWebS1141 ↗
CrutchS0538 ↗
UroburosS0022 ↗
PowerStallionS0393 ↗
GazerS0168 ↗
KazuarS0265 ↗
LightNeuronS0395 ↗
CarbonS0335 ↗
LunarMailS1142 ↗
HyperStackS0537 ↗
EpicS0091 ↗
TinyTurlaS0668 ↗
PenquinS0587 ↗
LunarLoaderS1143 ↗
Tools
Tools · 13ATT&CK
PsExecS0029 ↗
nbtstatS0102 ↗
netstatS0104 ↗
certutilS0160 ↗
EmpireS0363 ↗
IronNetInjectorS0581 ↗
ArpS0099 ↗
SysteminfoS0096 ↗
MimikatzS0002 ↗
TasklistS0057 ↗
NetS0039 ↗
RegS0075 ↗
NBTscanS0590 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Turla is cited as exploiting

none on KEV
  1. CVE-2019-115102026-10-17
    1. “CVE-2019-11510 Pulse Connect Secure (PCS) BERSERK BEAR COZY BEAR VENOMOUS BEAR”

      cited as exploiting · source: go.crowdstrike.com ↗ · 2026-10-17

  2. CVE-2017-02612026-10-17
    1. “Prior to this attack, Turla was also discovered using CVE-2017-0261 (a different EPS vulnerability).”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

  3. CVE-2012-17232026-10-17
    1. “Watering hole attacks using Java exploits (CVE-2012-1723), Flash exploits (unknown) or Internet Explorer 6,7,8 exploits (unknown)”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

    2. “Watering hole attacks using Java exploits (CVE-2012-1723), Flash exploits (unknown) or Internet Explorer 6,7,8 exploits (unknown)”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

  4. CVE-2013-33462026-10-17
    1. “Spearphishing e-mails with Adobe PDF exploits (CVE-2013-3346 + CVE-2013-5065)”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

    2. “Spearphishing e-mails with Adobe PDF exploits (CVE-2013-3346 + CVE-2013-5065)”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

  5. CVE-2013-50652026-10-17
    1. “The attackers behind Epic Turla have infected several hundred computers in more than 45 countries, including government institutions, embassies, military, education, research and pharmaceutical companies. The attacks are known to have used at least two zero-day exploits: CVE-2013-5065 – Privilege escalation vulnerability in Windows XP and Windows 2003”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

    2. “Spearphishing e-mails with Adobe PDF exploits (CVE-2013-3346 + CVE-2013-5065)”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2019Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against GovernmentsSymantec ↗
  2. 2018Turla group update Neuron malwareNCSC ↗
  3. 2017Carbon Paper: Peering into Turla second stage backdoorESET ↗
  4. 2017Introducing WhiteBearKaspersky ↗
  5. 2017Turla group using Neuron and Nautilus tools alongside Snake malwareNCSC ↗
  6. 2016Pacifier APTBitdefender ↗

Take it with you

keyless · no signup

References

44 sources
  1. 1.circl.lu/pub/tr-25
  2. 2.securelist.com/introducing-whitebear/81638
  3. 3.securelist.com/the-epic-turla-operation/65545
  4. 4.cfr.org/interactive/cyber-operations/turla
  5. 5.nytimes.com/2010/08/26/technology/26cyber.html
  6. 6.securelist.com/blog/research/67962/the-penquin-turla-2
  7. 7.kaspersky.com/blog/moonlight-maze-the-lessons/6713
  8. 8.www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf
  9. 9.securelist.com/analysis/publications/65545/the-epic-turla-operation
  10. 10.threatpost.com/linux-modules-connected-to-turla-apt-discovered/109765
  11. +34 more in the JSON record

Track Turla on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.