Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.(Citation: Accenture HyperStack October 2020)(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|

Turla has used compromised servers as infrastructure.(Citation: Recorded Future Turla Infra 2020)(Citation: Accenture HyperStack October 2020)(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.006|Web Services|

Turla has frequently used compromised WordPress sites for C2 infrastructure.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.003|Virtual Private Server|

Turla has used the VPS infrastructure of compromised Iranian threat actors.(Citation: NSA NCSC Turla OilRig)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Turla has used malware obtained after compromising other threat actors, such as

OilRig.(Citation: NSA NCSC Turla OilRig)(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|