Turla
SnakeVENOMOUS BearGroup 88WaterbugWRAITHUroburosPfinetTAG_0530KRYPTONHippo TeamPacifier APTPopeyeSIG23IRON HUNTERMAKERSMARKATK13
A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could… Source: MISP
Attributed country: RU according to MISP
Activity on Jábega · 12 weeks
2 stories · first seen on 10 Nov 2026 · last seen on 10 Nov 2026
News
- AI Makes Reverse Engineering Mainstream Software & Malware Far EasierDark Reading · 10 Nov 2026
- Turla hackers use new Ceral malware to spy on govt Exchange serversBleepingComputer · 10 Nov 2026
MITRE ATT&CK techniques
Resource Development
T1583.006Web ServicesT1584.003Virtual Private ServerT1584.004ServerT1584.006Web ServicesT1587.001Malware 10 Sigma rulesT1588.001Malware 1 Sigma rulesT1588.002Tool 7 Sigma rules
Initial Access
T1078.003Local Accounts 4 Sigma rulesT1189Drive-by Compromise 3 Sigma rulesT1566.002Spearphishing Link 3 Sigma rules
Execution
T1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1059.005Visual Basic 28 Sigma rulesT1059.006Python 10 Sigma rulesT1059.007JavaScript 26 Sigma rulesT1106Native API 12 Sigma rulesT1204.001Malicious Link 4 Sigma rules
Persistence
T1112Modify Registry 40 Sigma rulesT1546.003Windows Management Instrumentation Event Subscription 11 Sigma rulesT1546.013PowerShell Profile 3 Sigma rulesT1547.001Registry Run Keys / Startup Folder 38 Sigma rulesT1547.004Winlogon Helper DLL 4 Sigma rules
Privilege Escalation
T1055Process Injection 48 Sigma rulesT1055.001Dynamic-link Library Injection 7 Sigma rulesT1068Exploitation for Privilege Escalation 28 Sigma rulesT1134.002Create Process with Token 7 Sigma rules
Credential Access
Discovery
T1007System Service Discovery 7 Sigma rulesT1012Query Registry 11 Sigma rulesT1016System Network Configuration Discovery 4 Sigma rulesT1016.001Internet Connection DiscoveryT1018Remote System Discovery 9 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1057Process Discovery 3 Sigma rulesT1069.001Local Groups 6 Sigma rulesT1069.002Domain Groups 13 Sigma rulesT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1087.001Local Account 8 Sigma rulesT1087.002Domain Account 19 Sigma rulesT1120Peripheral Device DiscoveryT1124System Time Discovery 1 Sigma rulesT1201Password Policy Discovery 2 Sigma rulesT1518.001Security Software Discovery 5 Sigma rulesT1615Group Policy Discovery 4 Sigma rules
Lateral Movement
Collection
T1005Data from Local System 12 Sigma rulesT1025Data from Removable MediaT1213.006DatabasesT1560.001Archive via Utility 10 Sigma rules
Command and Control
T1071.001Web Protocols 39 Sigma rulesT1071.003Mail ProtocolsT1090Proxy 31 Sigma rulesT1090.001Internal Proxy 6 Sigma rulesT1102Web Service 17 Sigma rulesT1102.002Bidirectional Communication 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rules
Exfiltration
Stealth
T1027.005Indicator Removal from Tools 4 Sigma rulesT1027.010Command Obfuscation 8 Sigma rulesT1027.011Fileless Storage 1 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1564.012File/Path Exclusions
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗