Nation-stateEspionageATT&CK G0010

Turla

Also known as: Snake, Venomous Bear, Waterbug, WhiteBear, Secret Blizzard, IRON HUNTER

Turla is a long-running espionage group known for sophisticated custom tooling, above all the Snake implant, which US and allied agencies describe as the FSB's most sophisticated long-term collection tool. It uses watering-hole sites and spearphishing for access, hides its traffic in peer-to-peer networks of compromised machines, and has even reused another state group's malware.

Public attribution: Publicly attributed by US and allied agencies to Center 16 of Russia's Federal Security Service (FSB).
Active since: Around 2004
Targets: Governments and embassies
Military and defence organisations
Research, education and pharmaceutical organisations
Victims in over 50 countries

Notable campaigns

Up to 2023Snake implant
A peer-to-peer covert network of Snake-infected computers used for long-term collection; agencies say they tracked Snake for almost 20 years.
2019Reuse of OilRig tools
Turla used malware obtained after compromising the Iranian group OilRig (MITRE ATT&CK).
2023Snake network disruption
US authorities announced a court-authorised operation to disable Snake on compromised computers, alongside a joint advisory on hunting for it.

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Keep browsers and plugins patched and use browser isolation or script controls for high-risk users, since watering holes rely on drive-by exploitation.
Run EDR that detects process injection and unsigned kernel drivers.
Monitor egress for beaconing and for traffic to unusual web services; restrict direct internet access from servers.
Hunt proactively: long-dwell implants are found by hunting, not by waiting for alerts.

Learn and practise on CyberCertPrep

Threat hunting lab Memory forensics lab Glossary: command and control

Sources

Notable campaigns

Up to 2023Snake implant

A peer-to-peer covert network of Snake-infected computers used for long-term collection; agencies say they tracked Snake for almost 20 years.

2019Reuse of OilRig tools

Turla used malware obtained after compromising the Iranian group OilRig (MITRE ATT&CK).

2023Snake network disruption

US authorities announced a court-authorised operation to disable Snake on compromised computers, alongside a joint advisory on hunting for it.

Defences that work against this actor

Keep browsers and plugins patched and use browser isolation or script controls for high-risk users, since watering holes rely on drive-by exploitation.

Run EDR that detects process injection and unsigned kernel drivers.

Monitor egress for beaconing and for traffic to unusual web services; restrict direct internet access from servers.

Hunt proactively: long-dwell implants are found by hunting, not by waiting for alerts.