Turla
Threat actorAttributed to Russia by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- TurlaOur name
- BELUGASTURGEONAccenture
- KryptonCrowdStrike
- SnakeCrowdStrike
- Venomous BearCrowdStrike
- WhiteBearKaspersky
- Secret BlizzardMicrosoft
- Group 88MITRE ATT&CK
- IRON HUNTERSecureworks
- WaterbugSymantec
Targets
Sectors: Government, Defence, Education, Pharmaceuticals, Diplomatic
Source: MITRE ATT&CKKnown techniques
- T1005Data from Local System
- T1007System Service Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
- T1018Remote System Discovery
- T1021.002SMB/Windows Admin Shares
- T1025Data from Removable Media
- T1027.005Indicator Removal from Tools
- T1027.010Command Obfuscation
- T1027.011Fileless Storage
- T1036.005Match Legitimate Resource Name or Location
- T1049System Network Connections Discovery
- T1055Process Injection
- T1055.001Dynamic-link Library Injection
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.006Python
- T1059.007JavaScript
- T1068Exploitation for Privilege Escalation
- T1069.001Local Groups
- T1069.002Domain Groups
- T1071.001Web Protocols
- T1071.003Mail Protocols
- T1078.003Local Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1090Proxy
- T1090.001Internal Proxy
- T1102Web Service
- T1102.002Bidirectional Communication
- T1105Ingress Tool Transfer
- T1106Native API
- T1110Brute Force
- T1112Modify Registry
- T1120Peripheral Device Discovery
Malware and tools used
ArpCarboncertutilComRATCrutchEmpireEpicGazerHyperStackIronNetInjectorKazuarKOPILUWAKLightNeuronLunarLoaderLunarMailLunarWebMimikatzMosquitoNBTscannbtstatNetnetstatPenquinPowerStallionPsExecRegSysteminfoTasklistTinyTurlaUroburos
Source: MITRE ATT&CKRecent news
No stories yet.