← Back to Actors
Turla
TurlaIRON HUNTERGroup 88WaterbugWhiteBearSnakeKryptonVenomous BearSecret BlizzardBELUGASTURGEON
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation...
69
Techniques
65
Covered
4
Gaps
94%
Coverage
Coverage65/69
GAPS (4)
COVERED (65)
T1005Data from Local System51 det.T1007System Service Discovery15 det.T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery52 det.T1021.002SMB/Windows Admin Shares74 det.T1025Data from Removable Media3 det.T1027.005Indicator Removal from Tools6 det.T1027.010Command Obfuscation42 det.T1027.011Fileless Storage4 det.T1036.005Match Legitimate Resource Name or Location49 det.T1049System Network Connections Discovery23 det.T1055Process Injection83 det.T1055.001Dynamic-link Library Injection13 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1059.006Python55 det.T1059.007JavaScript64 det.T1068Exploitation for Privilege Escalation104 det.T1069.001Local Groups38 det.T1069.002Domain Groups45 det.T1071.001Web Protocols83 det.T1071.003Mail Protocols4 det.T1078.003Local Accounts24 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087.001Local Account35 det.T1087.002Domain Account58 det.T1090Proxy50 det.T1090.001Internal Proxy10 det.T1102Web Service36 det.T1102.002Bidirectional Communication17 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1110Brute Force100 det.T1112Modify Registry208 det.T1120Peripheral Device Discovery4 det.T1124System Time Discovery4 det.T1134.002Create Process with Token16 det.T1140Deobfuscate/Decode Files or Information59 det.T1189Drive-by Compromise13 det.T1201Password Policy Discovery20 det.T1204.001Malicious Link11 det.T1213.006Databases2 det.T1518.001Security Software Discovery11 det.T1546.003Windows Management Instrumentation Event Subscription18 det.T1546.013PowerShell Profile4 det.T1547.001Registry Run Keys / Startup Folder53 det.T1547.004Winlogon Helper DLL4 det.T1553.006Code Signing Policy Modification4 det.T1555.004Windows Credential Manager9 det.T1560.001Archive via Utility27 det.T1562.001Disable or Modify Tools332 det.T1566.002Spearphishing Link1194 det.T1567.002Exfiltration to Cloud Storage33 det.T1570Lateral Tool Transfer23 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.001Malware2 det.T1588.002Tool13 det.T1615Group Policy Discovery9 det.T1685Disable or Modify Tools281 det.