Log in Request a demo

Threat group profile

Turla

Also known as Venomous Bear, Secret Blizzard, Snake

Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004.

In short

Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004. In May 2023 the US and partners attributed the Snake malware to a unit in FSB Center 16, and on 14 July 2026 the EU named the FSB 16th Center as controlling groups including Turla.

Last updated 7 October 2026

Profile MapThreat Group
  1. Attributed OriginRussia
  2. Names11names in public reportsTurla · Waterbug · Venomous Bear
  3. Sectors7named as targetsGovernment · Diplomatic missions · Military and defense
  4. Techniques13in the attack chainInitial Access · Resource Development · Execution
  5. Tools10tools and malware listedUroburos · Kazuar · ComRAT

In one minute

Who they are
Russia's FSB is named by MITRE ATT&CK as the sponsor of Turla. CISA (May 2023) attributed the Snake malware to a unit in FSB Center 16, and the EU (14 July 2026) said that Center controls groups including Turla.
Who they target
MITRE lists government, embassies, military, education, research and pharmaceutical bodies in over 50 countries. The EU named nine member states as victims of the FSB 16th Center.
How they usually get in
MITRE lists watering holes, spearphishing links and compromised WordPress sites. CISA says Snake sits on external-facing network nodes.
What stands out
The UK NCSC and US NSA said in October 2019 that Turla took over Iranian tools and servers and used them against victims in dozens of countries, so the attacks looked Iranian.
What to do first
Patch internet-facing systems, require phishing-resistant MFA, use unique credentials per system, and apply the Suricata detection rules CISA published for Snake.

Names

Public reports use several names for this activity.

Names used for Turla
NameWhere it appears
Turla MITRE ATT&CK group name, G0010[1]
Waterbug MITRE Associated Groups ("appear to be the same group"); NCSC UK advisory, 21 October 2019[1, 3]
Venomous Bear MITRE Associated Groups; NCSC UK advisory, 21 October 2019[1, 3]
Snake MITRE Associated Groups; also the malware name in CISA advisory "Hunting Russian Intelligence "Snake" Malware"[1, 2, 7]
Uroburos Original name of the Snake malware in the CISA advisory; MITRE software S0022[2, 7]
Secret Blizzard MITRE Associated Groups[1]
Krypton MITRE Associated Groups[1]
WhiteBear MITRE Associated Groups (described there as overlapping with Turla activity)[1]
IRON HUNTER MITRE Associated Groups[1]
Group 88 MITRE Associated Groups[1]
BELUGASTURGEON MITRE Associated Groups[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Page version 5.1, modified 31 July 2026

    Turla is attributed to Russia's FSB, with victims in over 50 countries since at least 2004.[1]

  • UK NCSC with US NSA 21 October 2019

    Weight of evidence pointed to Turla for a campaign that used Iranian tools. Turla was described as suspected to be Russia-based.[3, 4]

  • CISA with partners 9 May 2023

    Snake malware attributed to a known unit within Center 16 of the FSB, with daily operations from an FSB facility in Ryazan.[2]

  • European Union (High Representative) 14 July 2026

    Exposed the 16th Centre of the FSB as controlling a variety of cyber threat groups including TURLA.[5]

  • UK Government July 2026

    With the EU, attributed the attack on Poland's energy grid to FSB Center 16. The page does not name Turla.[6]

Where sources differ

Sources differ on how the group maps to the FSB. MITRE says only "FSB". CISA (May 2023) ties the Snake malware to "a known unit within Center 16". The EU (July 2026) says the 16th Center controls several groups "including TURLA", so it treats Turla as one of several. The UK NCSC (2019) said only "suspected to be Russia-based". Spelling also differs: "Center 16" (CISA, UK) and "16th Center" (EU). The EEAS statement is dated 14 July 2026; the UK page gives only "July 2026".

Who they target

Sectors

  • GovernmentMITRE lists government victims. The EU lists strategic governmental entities in France since 2010 and governmental entities in Germany.[1, 5]
  • Diplomatic missionsMITRE lists embassies. LightNeuron was used against diplomatic and foreign affairs bodies.[1, 11]
  • Military and defenseMITRE lists military. The EU names the French defense industry in 2025.[1, 5]
  • Education and researchMITRE and CISA list education and research.[1, 2]
  • PharmaceuticalMITRE lists pharmaceutical companies.[1]
  • Critical infrastructureCISA lists financial services, critical manufacturing and communications. The EU describes sabotage of critical infrastructure in Poland by the FSB 16th Center.[2, 5]
  • Energy, technology and commercialNCSC 2019 lists government, military, technology, energy and commercial targets.[3, 4]

Regions

  • EuropeThe EU names France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland.[5]
  • Global (50 plus countries)CISA reports Snake infrastructure across North America, South America, Europe, Africa, Asia and Australia.[2]
  • Middle EastNCSC 2019 said victims of the Iranian-tools campaign were primarily in the Middle East.[4]
  • United States, Germany, AfghanistanMITRE says TinyTurla was used against targets in these places since at least 2020.[10]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. Late 2003

    Snake development starts

    CISA says the FSB began developing Snake as "Uroburos" in late 2003.[2]

  2. Early 2004

    First Snake versions done

    CISA says the initial implant versions were complete around early 2004. MITRE dates the group to at least 2004.[1, 2]

  3. 2007

    ComRAT first identified

    MITRE says ComRAT was originally identified in 2007 and is used by Turla.[9]

  4. 2010

    French government networks

    The EU says the FSB 16th Center ran espionage against strategic French government entities since 2010.[5]

  5. 2014

    LightNeuron and Penquin in use

    MITRE says LightNeuron has targeted Exchange servers since at least 2014 and Penquin has been used since at least 2014.[11, 12]

  6. 21 October 2019

    Iranian tools campaign exposed

    UK NCSC and US NSA said Turla used Iranian Neuron and Nautilus implants and infrastructure against victims in dozens of countries.[3, 4]

  7. 2020

    TinyTurla in use

    MITRE says Turla has used TinyTurla since at least 2020 against targets in the US, Germany and Afghanistan.[10]

  8. 9 May 2023

    CISA Snake advisory

    CISA attributed Snake to a unit within FSB Center 16 and published detection and mitigation guidance.[2]

  9. 2025

    French defense industry

    The EU says the FSB 16th Center ran espionage against the French defense industry in 2025.[5]

  10. July 2026

    UK and EU attribute Poland grid attack

    The UK and EU member states attributed the attack on Poland's energy grid to FSB Center 16.[6]

  11. 14 July 2026

    EU statement names Turla

    The EU said the FSB 16th Center controls groups including TURLA and imposed measures on nine individuals and four entities.[5]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about Turla
DateWhoWhat
21 October 2019 UK NCSC with US NSA AdvisoryExposed Turla's use of Iranian Neuron and Nautilus tools and infrastructure, with patching advice.[3, 4]
9 May 2023 CISA with partners Joint advisoryHunting Russian Intelligence "Snake" Malware: attribution to a unit in FSB Center 16, Suricata rules, mitigations.[2]
July 2026 UK Government Attribution and sanctionsWith EU member states, attributed the attack on Poland's energy grid to FSB Center 16 and announced sanctions on GRU leaders and others. The page does not name Turla.[6]
14 July 2026 European Union (High Representative) StatementExposed the FSB 16th Center as controlling groups including TURLA. Restrictive measures on nine individuals and four entities, not stated to be Turla members.[5]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Compromise Infrastructure: Web Services T1584.006

    MITRE says the group has frequently used compromised WordPress sites for C2.[1, 14]

  • Obtain Capabilities: Malware T1588.001

    MITRE lists malware obtained from other compromised actors.[1]

Initial Access

  • Drive-by Compromise T1189

    MITRE says the group has infected victims using watering holes.[1, 13]

  • Phishing: Spearphishing Link T1566.002

    MITRE lists spearphishing links for the group.[1]

  • Exploit Public-Facing Application T1190

    CISA lists this as the Snake access vector in its ATT&CK table.[2]

Execution

  • Command and Scripting Interpreter: PowerShell T1059.001

    MITRE lists PowerShell for command execution and in-memory loading.[1]

Persistence

  • Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003

    MITRE lists WMI event filters and consumers for persistence.[1]

Defense Evasion

  • Rootkit T1014

    CISA lists a kernel module rootkit among Snake techniques.[2]

Credential Access

  • OS Credential Dumping T1003

    CISA lists credential dumping among Snake techniques.[2]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    MITRE lists net use commands for lateral connections.[1]

Command and Control

  • Web Service T1102

    MITRE lists Pastebin, Dropbox and GitHub for C2.[1]

  • Application Layer Protocol: Mail Protocols T1071.003

    MITRE says multiple backdoors communicated via email attachments.[1]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    MITRE lists exfiltration to OneDrive and 4shared.[1]

Tools and malware

  • Uroburos Malware (also called Snake)

    Modular implant on external-facing nodes; CISA says development began in late 2003.[2, 7]

  • Kazuar Backdoor

    MITRE describes a .NET backdoor with reconnaissance and remote access.[8]

  • ComRAT Backdoor

    MITRE: second-stage implant first identified in 2007, with web and email C2.[9]

  • TinyTurla Backdoor

    MITRE: used since at least 2020 against targets in the US, Germany and Afghanistan.[10]

  • LightNeuron Backdoor

    MITRE: targets Microsoft Exchange servers, used against diplomatic and foreign affairs bodies.[11]

  • Penquin Linux backdoor

    MITRE: remote access trojan for Linux used since at least 2014.[12]

  • Carbon Backdoor

    Listed by MITRE for the group (S0335). CISA names Carbon (Cobra) as a related tool.[1, 2]

  • Mimikatz Credential tool

    MITRE lists it among software used by the group.[1]

  • Empire Post-exploitation framework

    MITRE lists it among software used by the group.[1]

  • Neuron and Nautilus Implants of Iranian origin

    NCSC 2019: very likely Iranian, taken over and used by Turla.[3, 4]

Also linked in our threat library:

Detection and defense

  1. Patch internet-facing systems

    Keep internet-facing products on the latest security updates. NCSC 2019 says patching is the most effective way to reduce the risk.

    Counters T1190

  2. Require phishing-resistant MFA

    CISA says it adds a layer of security even when credentials are stolen.

    Counters T1566.002 T1003

  3. Use unique credentials

    CISA says unique credentials stop the FSB abusing valid accounts. Avoid the same local password across systems.

    Counters T1003 T1021.002

  4. Segment the network

    CISA advises denying all connections by default unless required, to limit reach of Snake nodes and lateral movement.

    Counters T1021.002

  5. Deploy the CISA Suricata rules

    CISA published network rules to detect Snake traffic. Check external-facing nodes first.

    Counters T1014 T1071.003

  6. Harden browsing

    MITRE mitigations for drive-by compromise: update browsers, restrict web content, exploit protection, user training.

    Counters T1189

  7. Watch trusted web services

    Review outbound traffic to code, paste and file hosting services. MITRE notes compromised web services cannot be prevented from the victim side.

    Counters T1102 T1584.006 T1567.002

  8. If infected, reset from clean systems

    CISA advises changing credentials from non-compromised systems.

    Counters T1003

What Brandefense can do

Questions

Who is Turla?

MITRE attributes Turla to Russia's FSB. The EU said on 14 July 2026 that the FSB 16th Center controls groups including Turla. CISA attributed the Snake malware to a unit in Center 16 in May 2023.

Is it still active?

The EU statement of 14 July 2026 says the FSB has run malicious cyber activity "for years" and names espionage against the French defense industry in 2025. MITRE lists activity since at least 2004.

Who do they target?

MITRE lists governments, embassies, the military, education, research and pharmaceutical bodies in over 50 countries. The EU names nine member states.

How do they get in?

MITRE lists watering holes, spearphishing links and compromised WordPress sites. CISA says Snake is placed on external-facing nodes.

How can I tell if I am a target?

If you are a government, diplomatic, defense or research body, assume you are. Use the CISA Suricata rules and host checks for Snake.

What should I do first?

Patch internet-facing systems, require phishing-resistant MFA, use unique credentials and segment the network, as CISA and NCSC advise.

In our research

  1. Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse March 2026
  2. APT29 (Cozy Bear): Russia’s Stealth Espionage Powerhouse September 2025
  3. Analysis of Hybrid Warfare Through Russia-Ukraine Cyber War March 2022

Sources

  1. MITRE ATT&CK: Turla, Group G0010 MITRE Supports: FSB attribution, 50 countries, aliases, techniques, software
  2. Hunting Russian Intelligence "Snake" Malware (AA23-129A) CISA Supports: Center 16 attribution, Ryazan, 2003 start, 50 countries, mitigations
  3. Advisory: Turla group exploits Iranian APT to expand coverage of victims UK NCSC Supports: Aliases, Iranian tools, 35 countries, patching
  4. UK NCSC updates on the Turla Group UK NCSC Supports: 21 October 2019 statement, joint with NSA, Middle East victims
  5. Cyber / Russia: Statement by the High Representative on behalf of the European Union denouncing Russia's malicious cyber ecosystem targeting the EU, its member states and international partners EEAS Supports: 16th Centre controls groups including TURLA, nine member states
  6. UK and EU strike Russian cyber networks with new sanctions GOV.UK Supports: Poland grid attack attributed to FSB Centre 16
  7. MITRE ATT&CK: Uroburos, Software S0022 MITRE Supports: Snake alias, 2003, external-facing nodes
  8. MITRE ATT&CK: Kazuar, Software S0265 MITRE Supports: Kazuar description
  9. MITRE ATT&CK: ComRAT, Software S0126 MITRE Supports: ComRAT identified 2007
  10. MITRE ATT&CK: TinyTurla, Software S0668 MITRE Supports: Use since 2020 in US, Germany, Afghanistan
  11. MITRE ATT&CK: LightNeuron, Software S0395 MITRE Supports: Exchange backdoor, diplomatic targets
  12. MITRE ATT&CK: Penquin, Software S0587 MITRE Supports: Linux backdoor since 2014
  13. MITRE ATT&CK: Drive-by Compromise, T1189 MITRE Supports: Watering holes, mitigations
  14. MITRE ATT&CK: Compromise Infrastructure: Web Services, T1584.006 MITRE Supports: Compromised WordPress sites for C2

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Industry

Government and public sector

State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.

Read more

Role

SOC and CTI analyst

Give every alert the context it lacks, track the groups that matter to you and spend less time switching between tabs.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Malware

Snake (Uroburos)

Snake, also called Uroburos, is a cyber espionage implant written in C, with versions for Windows, Linux and macOS.

Read more