{ "family": "turla", "sample_count": 35, "category": "advanced_threat", "description": "Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cyber espionage framework operated by the Russian Federal Security Service (FSB) 16th Center (Military Unit 71330). With roots tracing back to the landmark 2008 Agent.BTZ compromise of the US Department of Defense, Turla has conducted targeted cyber espionage for over 15 years against government ministries, embassies, military command facilities, and intelligence agencies across more than 50 countries.\n\nTurla is renowned for unprecedented technical sophistication: it pioneered high-altitude satellite internet downlink hijacking (intercepting unencrypted satellite DVB-S streams from commercial providers in Africa and the Middle East to mask its C2 servers), complex internal peer-to-peer (P2P) mesh communications between isolated subnet victim nodes, and kernel-level rootkits. In May 2023, the United States Department of Justice, the FBI, and intelligence partners across the Five Eyes alliance executed 'Operation MEDUSA'—a court-authorized operation that deployed the FBI-developed 'PERSEUS' tool to communicate with and remotely issue self-disabling commands to the FSB's flagship Snake implant network worldwide.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "Turla", "Snake", "Uroburos", "Waterbug", "Venomous Bear", "KRYPTON" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Turla (Snake)?", "acceptedAnswer": { "@type": "Answer", "text": "Turla (also known as Snake or Uroburos) is a premier Russian state-sponsored cyber espionage framework operated by FSB Center 16 for long-term intelligence collection." } }, { "@type": "Question", "name": "What was Operation MEDUSA in May 2023?", "acceptedAnswer": { "@type": "Answer", "text": "Operation MEDUSA was a court-authorized FBI operation that used custom tool PERSEUS to send commands to the FSB's Snake implant network worldwide, disabling the malware on victim hosts." } }, { "@type": "Question", "name": "How did Turla use commercial satellite internet for C2?", "acceptedAnswer": { "@type": "Answer", "text": "Turla hijacked unencrypted commercial satellite downlinks, spoofing subscriber IP addresses so incoming C2 commands appeared from space without revealing the physical location of the server." } }, { "@type": "Question", "name": "What targets does Turla typically focus on?", "acceptedAnswer": { "@type": "Answer", "text": "Turla focuses on high-value intelligence targets including NATO entities, ministries of foreign affairs, defense departments, and critical research institutions across more than 50 nations." } }, { "@type": "Question", "name": "How can network defenders identify Turla activity?", "acceptedAnswer": { "@type": "Answer", "text": "Detect Turla by inspecting kernel driver signatures, monitoring unauthorized lateral SMB/RPC traffic between internal subnets, and deploying EDR rules detecting COM object hijacking." } } ], "faq_count": 5, "mitre_attack": [ "T1055", "T1542.003", "T1071.001", "T1071.004", "T1546.015", "T1027" ], "cisa_advisory": null, "last_updated": "2026-06-09", "mitre_attack_detail": [ { "id": "T1014", "name": "Rootkit", "tactic": "Defense Evasion" }, { "id": "T1090.002", "name": "Proxy: External Proxy", "tactic": "Command and Control" }, { "id": "T1055.001", "name": "Process Injection: Dynamic-link Library Injection", "tactic": "Defense Evasion" }, { "id": "T1074.001", "name": "Data Staged: Local Data Staging", "tactic": "Collection" }, { "id": "T1566.001", "name": "Phishing: Spearphishing Attachment", "tactic": "Initial Access" } ], "containment_steps": [ "Assume total domain compromise. Turla operates with extreme stealth; if one endpoint is detected, they likely have entrenched rootkits across the network.", "Engage a Tier-1 Incident Response retainer immediately; standard internal SOC teams are rarely equipped to hunt a top-tier Russian FSB unit.", "Do NOT initiate remediation piecemeal; Turla will observe the cleanup efforts and deploy destructive wipers or deeper persistence mechanisms. Remediation must be coordinated and instantaneous.", "Perform deep memory forensics (RAM dumps) on critical servers to detect the presence of the Uroburos/Snake kernel-level rootkits." ], "what_to_avoid": [ "Do not alert the attackers by attempting to block their C2 domains prematurely; monitor their traffic to understand the full scope of the breach before executing a coordinated eviction.", "Avoid relying on standard antivirus scans; Turla's tools operate below the OS layer and will return false negatives." ], "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "persistence", "command_and_control", "remote_access" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2007, "lineage": { "derived_from": [ "agent.btz" ], "variants": [ "snake / uroburos rootkit", "carbon", "epic turla", "gazer", "mosquito", "tinyturla (2021)" ] }, "attribution": [ { "actor": "Russian FSB 16th Center (Military Unit 71330) / FBI Operation MEDUSA (May 2023)", "confidence": "high", "basis": "Joint advisory issued in May 2023 by CISA, FBI, NSA, UK NCSC, and Five Eyes partners formally attributing Snake/Turla to Center 16 of the Russian Federal Security Service (FSB), accompanied by the Operation MEDUSA court-authorized disruption.", "source": "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-snake-malware-network-controlled" } ], "exploited_cves": [ "CVE-2013-3346", "CVE-2017-0199", "CVE-2018-8453" ], "c2_profile": { "protocols": [ "Satellite Downlink Hijacking (TCP over DVB-S)", "HTTP", "HTTPS", "DNS Tunneling", "P2P Subnet Mesh" ], "ports": [ 80, 443, 53 ], "infrastructure": "High-altitude satellite internet downlinks abusing unencrypted commercial satellite receivers, combined with multi-hop peer-to-peer internal network relays routing stolen intelligence through a single egress node." }, "iocs": { "file_hashes": [ "0f62d1c9ad9a64797a731efc1b4cfb0cc5a1b5d12de1d668749a46995642456e", "294ac5e533c37560d2b8feeb492f58cfcb6c3c6efec24bb93b22cfd8ccb05612" ], "delivery": [ "Spear-phishing emails containing malicious documents targeting defense and foreign affairs ministries (CVE-2017-0199)", "Strategic web compromise (watering hole attacks) injecting malicious JavaScript into government web portals" ], "persistence": [ "Kernel-mode drivers (.sys) registered as core Windows services", "Component Object Model (COM) hijacking and stealth memory injection into lsass.exe" ] }, "sources": [ { "name": "US Department of Justice Press Release - Operation MEDUSA Snake Disruption", "url": "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-snake-malware-network-controlled" }, { "name": "CISA Joint Cybersecurity Advisory - Hunting Russian FSB Snake Malware", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a" }, { "name": "MITRE ATT&CK - Turla (G0010)", "url": "https://attack.mitre.org/groups/G0010/" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }