Uptime Hamster: 112d 23h 1mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza Turla Group

Turla Group

0 incidentes 0 paises 0 sectores apt Russian Federation Ultimo: -
Aliases: Turla, ATK13, Blue Python, G0010, Group 88, Hippo Team, IRON HUNTER, ITG12, KRYPTON, MAKERSMARK, Pacifier APT, Pfinet, Popeye, SIG23, SUMMIT, Secret Blizzard, Snake, TAG_0530
Ver en IntelTracker → APTTrail →
Turla Group, often recognized as one of the earliest active cyber espionage groups, emerged in the late 1990s, with activities possibly linked to the Moonlight Maze operation. This Russian state-sponsored threat actor is consistently attributed to the Federal Security Service (FSB) and has maintained its operational tempo without significant shifts in its core espionage mission. The group's primary motivation is long-term intelligence gathering to serve Russian geopolitical, military, and diplomatic objectives, lacking any financial impetus. What distinctly sets Turla apart is its pioneering use of satellite communications for command and control (C2) to obfuscate its activities, alongside an adaptable strategy that includes hijacking the infrastructure of other nation-state threat groups. Turla operates under numerous aliases, such as Snake, Uroburos, Waterbug, Venomous Bear, Pensive Ursa, and Secret Blizzard, which has historically necessitated careful disambiguation by security rese

Aliases del actor

TurlaATK13Blue PythonG0010Group 88Hippo TeamIRON HUNTERITG12KRYPTONMAKERSMARKPacifier APTPfinetPopeyeSIG23SUMMITSecret BlizzardSnakeTAG_0530UAC-0003UAC-0024UAC-0144UNC4210UroburosVENOMOUS BearWRAITHWaterbugalias sugiere que debe ser monitoreado con atención

Actores similares

apt-desertfalconactor · 1apt-equationgroupactor · 1apt-group5actor · 1Energetic Bearapt · 0turla-groupactor · 1UAC-0194apt · 0UAC-0185apt · 0UAC-0020apt · 0WIRTE Groupapt · 0UAC-0219apt · 0
Motivacion
Information theft and espionage, Financial crime
Malware asociado
prometei, TinyTurla, elf.perfctl, win.turla_rpc, SEASHARPEE, Epic
Tecnicas MITRE
T1047 - Windows Management Instrumentation, T1112, T1018 - Remote System Discovery, T1566, T1095, T1550
CVEs relacionadas
CVE-2025-6543, CVE-2025-5777, CVE-2025-52579, CVE-2025-31199, CVE-2025-22457, CVE-2025-21590
Tipo
apt
Pais origen
Russian Federation
Motivacion
Information theft and espionage, Financial crime
Impacto
122
Actualizado
Wed, 01 Ju

Paises objetivo (OSINT)

AfghanistanArmeniaAustriaAustraliaAzerbaijanBelgiumBolivia, Plurinational State ofBrazilBotswanaBelarus

Sectores objetivo (OSINT)

Energy & Utilities RetailEducational ServicesPublic AdministrationChemical&Pharmaceutical ManufacturingElectrical&Electronical ManufacturingSpace & DefenseNational Security&International AffairsHospitalsAir Transportation