216.73.217.22

Turla

· Published 16/12/2025 19:39 · Modified 04/05/2026 16:33 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
04/05/2026 16:33
Updated at
04/05/2026 16:33
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
5 reports, 132 attack patterns (mitre), 39 malware, 8 sectors, 7 countries, 100 indicators, 2 vulnerabilities (cve), 12 tool

Aliases

IRON HUNTER Group 88 Waterbug WhiteBear Snake Krypton Venomous Bear BELUGASTURGEON Secret Blizzard

Description

[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (5)

Attack patterns (MITRE) (132)

Malware (39)

  • QUIETCANARY uses
    Family The MITRE Corporation Confidence 100

    [QUIETCANARY](https://attack.mitre.org/software/S1076) is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.(Citation: Mandiant Suspected Turla Campaign …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:37 · Modified 27/03/2026 01:05
  • TinyTurla-NG
  • MiniPocket uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • TurlaPower-NG
  • ActionRat uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • HyperStack
  • CrimsonRAT uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • Penquin
  • Carbon
  • AllaKore uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:39 · Modified 21/12/2025 00:13
  • Amadey - S1025 uses
    Family
    Published 29/09/2025 08:06 · Modified 29/09/2025 08:06
  • TinyTurla
  • ApolloShadow
  • Epic
  • KazuarV2 uses
    Family
    Published 13/12/2024 13:28 · Modified 13/12/2024 13:28
  • Capibar
  • Kazuar
  • KOPILUWAK
  • Uroburos - S0022 uses
    Family
    Published 08/07/2024 10:45 · Modified 08/07/2024 10:45
  • ComRAT - S0126
  • TinyTurla - S0668 uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • Chisel uses
    Family
    Published 16/06/2026 14:27 · Modified 16/06/2026 14:27
  • Kazuar - S0265 uses
    Family
    Published 28/05/2026 19:56 · Modified 28/05/2026 19:56
  • Crutch
  • LunarLoader
  • HyperStack - S0537
  • LunarMail uses
    Family
    Published 16/05/2024 09:35 · Modified 16/05/2024 09:35
  • ComRAT
  • Mosquito
  • LightNeuron
  • Gazer
  • Wainscot uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • TwoDash uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • Pelmeni uses
    Family
    Published 14/05/2026 20:10 · Modified 14/05/2026 20:10
  • LunarWeb uses
    Family
    Published 16/05/2024 09:35 · Modified 16/05/2024 09:35
  • PowerStallion
  • Crutch - S0538
  • Statuezy uses
    Family
    Published 05/12/2024 02:56 · Modified 05/12/2024 02:56
  • Waiscot uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:49 · Modified 21/12/2025 08:41

Sectors (8)

  • Telecommunications targets
  • Ministries of foreign affairs targets
  • Government targets
  • Education targets
  • NGO targets
  • Defense targets
  • Defense ministries (including the military) targets
  • Energy targets

Countries (7)

  • Ukraine targets
  • British Indian Ocean Territory targets
  • Russian Federation targets
  • Philippines targets
  • Pakistan targets
  • Afghanistan targets
  • India targets

Indicators (100)

Vulnerabilities (CVE) (2)

CVE-2022-38028 KEV
7.8 High

Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with …

Attack vector
Local
Published
23/04/2024
Modified
21/12/2025
CVE-2025-31199
5.5 Medium

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, …

Attack vector
Local
Complexity
Low
Published
30/05/2025
Modified
02/04/2026

Tool (12)

  • certutil uses
    The MITRE Corporation Confidence 100

    [certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Reg uses
    The MITRE Corporation Confidence 100

    [Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • netstat uses
    The MITRE Corporation Confidence 100

    [netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Arp uses
    The MITRE Corporation Confidence 100

    [Arp](https://attack.mitre.org/software/S0099) displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07
  • NBTscan uses
    The MITRE Corporation Confidence 100

    [NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June …

    Published 17/03/2021 16:26 · Modified 27/03/2026 01:07
  • Net uses
    The MITRE Corporation Confidence 100

    The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • nbtstat uses
    The MITRE Corporation Confidence 100

    [nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • IronNetInjector uses
    The MITRE Corporation Confidence 100

    [IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including [ComRAT](https://attack.mitre.org/software/S0126).(Citation: Unit …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • Tasklist uses
    The MITRE Corporation Confidence 100

    The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It …

    Published 16/12/2025 19:37 · Modified 27/03/2026 01:07
  • PsExec uses
    The MITRE Corporation Confidence 100

    [PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • Systeminfo uses
    The MITRE Corporation Confidence 100

    [Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)

    Published 31/05/2017 23:33 · Modified 27/03/2026 01:07