Turla - G0010

Created: 2017-05-31T21:31:49.816Z

Modified: 2023-03-22T05:41:28.428Z

Contributors: Matthieu Faou, ESET,Edward Millington

Aliases

Turla,IRON HUNTER,Group 88,Belugasturgeon,Waterbug,WhiteBear,Snake,Krypton,Venomous Bear

Description

Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. Turla’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)

Techniques Used

Turla has modify Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|Windows|T1615|Group Policy Discovery|

Turla surveys a system upon check-in to discover Group Policy details using the

Turla has obtained and customized publicly-available tools like

Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|