{
  "id": "turla",
  "name": "Turla",
  "aliases": [
    "IRON HUNTER",
    "Group 88",
    "Waterbug",
    "WhiteBear",
    "Snake",
    "Krypton",
    "Venomous Bear",
    "Secret Blizzard",
    "BELUGASTURGEON"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russia's Federal Security Service (FSB)",
      "src": [
        "mitre-g0010"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2004,
      "src": [
        "mitre-g0010"
      ],
      "conf": "medium",
      "note": "At least 2004"
    },
    {
      "k": "attack_id",
      "v": "G0010",
      "src": [
        "mitre-g0010"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 68,
      "src": [
        "mitre-g0010"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Arp, Carbon, certutil, ComRAT, Crutch, Empire, Epic, Gazer, HyperStack, IronNetInjector, Kazuar, KOPILUWAK, LightNeuron, LunarLoader, LunarMail, LunarWeb, Mimikatz, Mosquito, NBTscan, nbtstat and 10 more",
      "src": [
        "mitre-g0010"
      ],
      "conf": "high",
      "note": "30 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0010)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/turla.html",
  "sources": {
    "mitre-g0010": {
      "title": "Turla, Group G0010",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0010/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}