{
  "family": "turla",
  "sample_count": 35,
  "category": "backdoor",
  "description": "ThreatActor:Turla (also tracked as Waterbug, Venomous Bear, Krypton, and Uroburos) is a highly sophisticated, top-tier Advanced Persistent Threat (APT) group attributed to the Russian Federal Security Service (FSB). Active since at least the early 2000s, Turla is responsible for some of the most complex, stealthy espionage campaigns in history, targeting military, diplomatic, and government entities across dozens of countries (including the devastating 2008 breach of US CENTCOM via the Agent.btz worm).<br><br><b>The Turla Arsenal</b><br>Turla is renowned for its custom, highly advanced malware engineering. They do not rely heavily on off-the-shelf tools. Their flagship tool was **Uroburos** (or Snake), an incredibly complex kernel-mode rootkit (`T1014`) capable of deep network traffic interception, completely bypassing host-based firewalls. Uroburos utilized custom Virtual File Systems (VFS) to hide its components from the operating system and forensic tools. They also developed sophisticated modular backdoors like **Epic Turla**, **Carbon**, and **Kazuar**.<br><br><b>Satellite IP Hijacking & Evasion</b><br>Turla's most legendary evasion technique is Satellite IP Hijacking (`T1090.002`). To mask their Command and Control (C2) infrastructure, Turla would identify legitimate users of unencrypted commercial satellite internet (DVB-S) in Africa and the Middle East. They would spoof the IPs of these users. When a compromised endpoint sent stolen data to the spoofed IP, the satellite beamed the data back down over a massive geographic area. Turla, equipped with a standard satellite dish in a different country, would passively sniff the unencrypted downstream traffic, completely obfuscating their true physical location from Western intelligence agencies.<br><br><b>Indicators of Compromise & Defense</b><br>Defending against Turla requires nation-state level threat hunting. Their rootkits actively subvert EDR platforms by hooking deep into the Windows Kernel. Detection relies on deep memory forensics to identify unlinked processes, advanced network anomaly detection (specifically identifying beaconing traffic to satellite provider IP ranges), and strict architectural segregation. Compromise by Turla almost always requires a complete rebuild of the affected domain infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1014",
    "T1074.001",
    "T1090.002",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1090.002",
      "name": "Proxy: External Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1074.001",
      "name": "Data Staged: Local Data Staging",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Assume total domain compromise. Turla operates with extreme stealth; if one endpoint is detected, they likely have entrenched rootkits across the network.",
    "Engage a Tier-1 Incident Response retainer immediately; standard internal SOC teams are rarely equipped to hunt a top-tier Russian FSB unit.",
    "Do NOT initiate remediation piecemeal; Turla will observe the cleanup efforts and deploy destructive wipers or deeper persistence mechanisms. Remediation must be coordinated and instantaneous.",
    "Perform deep memory forensics (RAM dumps) on critical servers to detect the presence of the Uroburos/Snake kernel-level rootkits."
  ],
  "what_to_avoid": [
    "Do not alert the attackers by attempting to block their C2 domains prematurely; monitor their traffic to understand the full scope of the breach before executing a coordinated eviction.",
    "Avoid relying on standard antivirus scans; Turla's tools operate below the OS layer and will return false negatives."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}