Turla

    RussiaState-sponsoredUnknown

    Observation period

    68

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest. Embassies in Belgium, Ukraine, China, Jordan, Greece, Kazakhstan, Armenia, Poland, and Germany were all attacked, though researchers from Kaspersky Lab and Symantec could not confirm which countries were the true targets. In one case from May 2012, the office of the prime minister of a former Soviet Union member country was infected, leading to 60 further computers being affected, Symantec researchers said. There were some other victims, including the ministry for health of a Western European country, the ministry for education of a Central American country, a state electricity provider in the Middle East and a medical organisation in the US, according to Symantec. It is believed the group was also responsible for a much - documented 2008 attack on the US Central Command. The attackers - who continue to operate - have ostensibly sought to carry out surveillance on targets and pilfer data, though their use of encryption across their networks has made it difficult to ascertain exactly what the hackers took.Kaspersky Lab, however, picked up a number of the attackers searches through their victims emails, which included terms such as Nato and EU energy dialogue Though attribution is difficult to substantiate, Russia has previously been suspected of carryin…

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government
    • Military

    Target countries according to source France, Romania, Kazakhstan, Poland, Tajikistan, Russia, United States, Saudi Arabia, Germany, India, Belarus, Netherlands, Iran, Uzbekistan, Iraq

    Aliases

    • Snake
    • VENOMOUS Bear
    • Group 88
    • Waterbug
    • WRAITH
    • Uroburos
    • Pfinet
    • TAG_0530
    • KRYPTON
    • Hippo Team
    • Pacifier APT
    • Popeye
    • SIG23
    • IRON HUNTER
    • MAKERSMARK
    • ATK13
    • ITG12
    • Blue Python
    • SUMMIT
    • UNC4210
    • Secret Blizzard
    • UAC-0144
    • UAC-0024
    • UAC-0003
    • TURLA RELIC

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview