CVE Intelligence
Início / Grupos de ameaça / Turla

Turla G0010

🔔 Criar alerta

Também conhecido como: IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0
CVEs associadas
79
Técnicas
30
Malwares e ferramentas

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Desenvolvimento de recursos
T1583.006 Web ServicesT1584.003 Virtual Private ServerT1584.004 ServerT1584.006 Web ServicesT1587.001 MalwareT1588.001 MalwareT1588.002 Tool
Acesso inicial
T1078.003 Local AccountsT1189 Drive-by CompromiseT1566.002 Spearphishing Link
Execução
T1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1059.007 JavaScriptT1106 Native APIT1204.001 Malicious Link
Persistência
T1078.003 Local AccountsT1112 Modify RegistryT1546.003 Windows Management Instrumentation Event SubscriptionT1546.013 PowerShell ProfileT1547.001 Registry Run Keys / Startup FolderT1547.004 Winlogon Helper DLL
Escalada de privilégios
T1055 Process InjectionT1055.001 Dynamic-link Library InjectionT1068 Exploitation for Privilege EscalationT1078.003 Local AccountsT1134.002 Create Process with TokenT1546.003 Windows Management Instrumentation Event SubscriptionT1546.013 PowerShell ProfileT1547.001 Registry Run Keys / Startup FolderT1547.004 Winlogon Helper DLL
Furtividade
T1027.005 Indicator Removal from ToolsT1027.010 Command ObfuscationT1027.011 Fileless StorageT1036.005 Match Legitimate Resource Name or LocationT1055 Process InjectionT1055.001 Dynamic-link Library InjectionT1078.003 Local AccountsT1134.002 Create Process with TokenT1140 Deobfuscate/Decode Files or InformationT1564.012 File/Path Exclusions
Comprometimento de defesas
T1112 Modify RegistryT1553.006 Code Signing Policy ModificationT1685 Disable or Modify Tools
Acesso a credenciais
T1110 Brute ForceT1555.004 Windows Credential Manager
Descoberta
T1007 System Service DiscoveryT1012 Query RegistryT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.001 Local GroupsT1069.002 Domain GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1120 Peripheral Device DiscoveryT1124 System Time DiscoveryT1201 Password Policy DiscoveryT1518.001 Security Software DiscoveryT1615 Group Policy Discovery
Movimento lateral
T1021.002 SMB/Windows Admin SharesT1570 Lateral Tool Transfer
Coleta
T1005 Data from Local SystemT1025 Data from Removable MediaT1213.006 DatabasesT1560.001 Archive via Utility
Comando e controle
T1071.001 Web ProtocolsT1071.003 Mail ProtocolsT1090 ProxyT1090.001 Internal ProxyT1102 Web ServiceT1102.002 Bidirectional CommunicationT1105 Ingress Tool Transfer
Exfiltração
T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.