Turla
SnakeVENOMOUS BearGroup 88WaterbugWRAITHUroburosPfinetTAG_0530KRYPTONHippo TeamPacifier APTPopeyeSIG23IRON HUNTERMAKERSMARKATK13
A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could… Fuente: MISP
País atribuido: RU según MISP
Actividad en Jábega · 12 semanas
2 noticias · vista por primera vez el 10 nov 2026 · la última, el 10 nov 2026
Noticias
- AI Makes Reverse Engineering Mainstream Software & Malware Far EasierDark Reading · 10 nov 2026
- Turla hackers use new Ceral malware to spy on govt Exchange serversBleepingComputer · 10 nov 2026
Técnicas MITRE ATT&CK
Preparación de recursos
T1583.006Web ServicesT1584.003Virtual Private ServerT1584.004ServerT1584.006Web ServicesT1587.001Malware 10 reglas SigmaT1588.001Malware 1 reglas SigmaT1588.002Tool 7 reglas Sigma
Acceso inicial
T1078.003Local Accounts 4 reglas SigmaT1189Drive-by Compromise 3 reglas SigmaT1566.002Spearphishing Link 3 reglas Sigma
Ejecución
T1059.001PowerShell 40 reglas SigmaT1059.003Windows Command Shell 40 reglas SigmaT1059.005Visual Basic 28 reglas SigmaT1059.006Python 10 reglas SigmaT1059.007JavaScript 26 reglas SigmaT1106Native API 12 reglas SigmaT1204.001Malicious Link 4 reglas Sigma
Persistencia
T1112Modify Registry 40 reglas SigmaT1546.003Windows Management Instrumentation Event Subscription 11 reglas SigmaT1546.013PowerShell Profile 3 reglas SigmaT1547.001Registry Run Keys / Startup Folder 38 reglas SigmaT1547.004Winlogon Helper DLL 4 reglas Sigma
Escalada de privilegios
T1055Process Injection 48 reglas SigmaT1055.001Dynamic-link Library Injection 7 reglas SigmaT1068Exploitation for Privilege Escalation 28 reglas SigmaT1134.002Create Process with Token 7 reglas Sigma
Acceso a credenciales
Descubrimiento
T1007System Service Discovery 7 reglas SigmaT1012Query Registry 11 reglas SigmaT1016System Network Configuration Discovery 4 reglas SigmaT1016.001Internet Connection DiscoveryT1018Remote System Discovery 9 reglas SigmaT1049System Network Connections Discovery 2 reglas SigmaT1057Process Discovery 3 reglas SigmaT1069.001Local Groups 6 reglas SigmaT1069.002Domain Groups 13 reglas SigmaT1082System Information Discovery 18 reglas SigmaT1083File and Directory Discovery 17 reglas SigmaT1087.001Local Account 8 reglas SigmaT1087.002Domain Account 19 reglas SigmaT1120Peripheral Device DiscoveryT1124System Time Discovery 1 reglas SigmaT1201Password Policy Discovery 2 reglas SigmaT1518.001Security Software Discovery 5 reglas SigmaT1615Group Policy Discovery 4 reglas Sigma
Movimiento lateral
Recopilación
T1005Data from Local System 12 reglas SigmaT1025Data from Removable MediaT1213.006DatabasesT1560.001Archive via Utility 10 reglas Sigma
Mando y control
T1071.001Web Protocols 39 reglas SigmaT1071.003Mail ProtocolsT1090Proxy 31 reglas SigmaT1090.001Internal Proxy 6 reglas SigmaT1102Web Service 17 reglas SigmaT1102.002Bidirectional Communication 3 reglas SigmaT1105Ingress Tool Transfer 40 reglas Sigma
Exfiltración
Stealth
T1027.005Indicator Removal from Tools 4 reglas SigmaT1027.010Command Obfuscation 8 reglas SigmaT1027.011Fileless Storage 1 reglas SigmaT1036.005Match Legitimate Resource Name or Location 20 reglas SigmaT1140Deobfuscate/Decode Files or Information 17 reglas SigmaT1564.012File/Path Exclusions
Defense impairment
Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy, MITRE ATT&CK y SigmaHQ. attack.mitre.org ↗