TurlaThreat actor
- atk13
- belugasturgeon
- blue python
- g0010
- group 88
- hippo team
- iron hunter
- itg12
- makersmark
- pacifier apt
- pfinet
- popeye
- secret blizzard
- sig23
- tag_0530
- turla relic
- uac-0003
- uac-0024
- uac-0144
- unc4210
- venomous bear
- waterbug
- whitebear
- wraith
A 2014 Guardian article described Turla as: 'Dubbed the Turla hackers, initial intelligence had indicated western powers were key targets, but it was later determined embassies for Eastern Bloc nations were of more interest.From MISP Galaxy
Last reported yesterday, by The Hacker News12 reports
ATT&CK techniques
6 of 54 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.006HTML Smuggling
“Al igual que en años anteriores, la mayoría utilizó archivos comprimidos o archivos XHTML que empleaban HTML smuggling para entregar downloaders HTA maliciosos, los cuales a su vez descargaban el downloader en VBScript PteroSand y payloads adicionales.”
- T1036Masquerading
“… versions of the malware observed by GTIG retained the internal aspects of this disguise, in 2025 we identified variants of STOCKSTAY masquerading as other benign applications, such as PDF viewers and calculator utilities.”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1071.001Web Protocols
“T1071.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“Last year, ESET said it identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“A principios de 2025, descubrimos que Gamaredon, un grupo alineado con Rusia, colaboró con Turla, otro actor de amenazas también alineado con Rusia; documentamos nuestros hallazgos en nuestra publicación Gamaredon X Turla collab.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“Earlier in 2025, we uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor; we documented our findings in our blogpost Gamaredon X Turla collab.”
-
Cyber Brief 26-08 - July 2026“…cyber policy and law enforcement, the Council of the European Union sanctioned nine individuals and four entities linked to FSB-directed Turla operations, while Europol coordinated the removal of thousands of URLs associated with the cybercrime group The Com.”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“De manera destacada, descubrimos que a comienzos de 2025 Gamaredon colaboró con Turla, otro actor de amenazas alineado con Rusia y también vinculado al FSB; documentamos estos hallazgos en nuestra publicación Colaboración entre Gamaredon y Turla.”
-
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus“STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“Notably, we uncovered that in early 2025, Gamaredon collaborated with Turla, another Russia-aligned threat actor also linked to the FSB; we documented our findings in our blogpost Gamaredon X Turla collab.”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“This publication documented the exploitation of this vulnerability by Russian operators Sandworm, Turla, Gamaredon, and China-nexus intrusion-sets.”
-
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open“…at landscape was defined by a handful of known actors: Pawn Storm (also known as APT28), Sandworm, Earth Koshchei (also known as APT29), Turla, and Earth Dahu (also known as Gamaredon).”
-
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine“LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“In September 2025, ESET published a report discussing some collaboration between Gamaredon and Turla, two Russia-aligned intrusion sets.”
-
Google Workspace Attack Surface“With attribution pointed towards advanced persistent threat (APT) group, Turla, the abuse of Gmail is also a tool for more advanced threats.”
Indicators in its reports
named in the reports above- teletype[.]inin 3 reports
- devtunnels[.]msin 2 reports
- mil.gov[.]uain 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- write[.]asin 2 reports
- lesma[.]euin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- tebi[.]ioin 2 reports
- de-fra.i3storage[.]comin 2 reports
Copy these 13 indicators · defanged
Thanks — we review every report.