group
Turla G0010
- Created
- 31 May 2017
- Last modified
- 31 July 2026
- Aliases
- Turla · IRON HUNTER · Group 88 · Waterbug · WhiteBear · Snake · Krypton · Venomous Bear · Secret Blizzard · BELUGASTURGEON
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0010
Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.7
Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command.8 Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .9
Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan.101112 Turla RPC backdoors have also retrieved registered RPC interface information from process memory.13
Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.1516
Standing G0010
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
94th percentile · 94% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
85th percentile · 85% of 176 ATT&CK groups have this many tactics spanned or fewer.
99th percentile · 99% of 176 ATT&CK groups have this many tools and malware or fewer.
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
40th percentile · 60% of 176 ATT&CK groups have more detection rules per technique.
Detection coverage G0010
1852 distinct rules cover the 68 techniques recorded for this group. The 2130 technique-to-rule mappings resolve to 1852 distinct rules, because one rule can cover several techniques. 1197 Sigma · 655 Splunk.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org