turla-venomous-bear

name	turla-venomous-bear
description	Adversary-emulation profile for Turla (G0010 / Venomous Bear / Secret Blizzard / Waterbug / KRYPTON / Snake), Russia's FSB Center 16 cyber-espionage actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"Turla, Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake, IRON HUNTER, BELUGASTURGEON, WhiteBear, FSB Center 16, G0010, Russian FSB espionage emulation, Snake rootkit, Uroburos, ComRAT, Carbon framework, Kazuar backdoor, LightNeuron Exchange, Penquin Linux, TinyTurla, satellite C2, watering hole attacks, hijacking other APT infrastructure, DNS-over-HTTPS C2, Gmail C2","tags":"turla, venomous-bear, secret-blizzard, waterbug, krypton, snake, fsb, russia, espionage, nation-state, g0010, adversary-emulation, mitre-attack","mitre_attack":"T1583.006, T1584.003, T1584.004, T1584.006, T1587.001, T1588.001, T1588.002, T1189, T1566.001, T1566.002, T1204.001, T1204.002, T1078.003, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1047, T1106, T1569.002, T1547.001, T1547.004, T1546.003, T1546.013, T1546.015, T1543.003, T1505.002, T1053.003, T1053.005, T1137.006, T1574.001, T1068, T1055, T1055.001, T1134.002, T1553.006, T1014, T1027, T1027.002, T1027.005, T1027.009, T1027.010, T1027.011, T1027.013, T1036.004, T1036.005, T1140, T1112, T1070.004, T1070.006, T1070.008, T1564.004, T1564.005, T1564.012, T1218.011, T1685, T1620, T1497.003, T1001.001, T1001.002, T1001.003, T1110, T1555.004, T1003.001, T1003.002, T1003.004, T1003.006, T1056.001, T1558.001, T1558.002, T1550.002, T1087.001, T1087.002, T1083, T1615, T1120, T1069.001, T1069.002, T1057, T1012, T1018, T1518.001, T1082, T1016, T1016.001, T1049, T1007, T1124, T1201, T1135, T1033, T1010, T1046, T1680, T1021.002, T1570, T1005, T1025, T1213.006, T1560.001, T1119, T1074.001, T1113, T1125, T1114.001, T1114.002, T1071.001, T1071.002, T1071.003, T1071.004, T1102, T1102.002, T1573.001, T1573.002, T1090, T1090.001, T1090.003, T1095, T1572, T1008, T1104, T1105, T1132.001, T1132.002, T1029, T1030, T1205, T1205.002, T1041, T1567.002, T1048.003, T1020, T1485"}

Turla (Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake) — Adversary Emulation Profile

Turla (MITRE ATT&CK G0010) is one of the most sophisticated and long-running cyber-espionage groups in existence, attributed to Russia's Federal Security Service (FSB) Center 16, operating since at least 2004. Turla has compromised victims in over 50 countries across government, diplomatic, military, defense, education, research, and pharmaceutical sectors. The group is characterized by extraordinary technical depth — from the Snake/Uroburos kernel rootkit and satellite-based C2 hijacking to steganographic email backdoors and the audacious practice of hijacking other nation-state APTs' infrastructure. Turla's tooling spans Windows, Linux, and macOS, with a malware ecosystem (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, TinyTurla, Lunar toolset) unmatched in breadth and longevity. The 2023 FBI Operation MEDUSA takedown of the Snake peer-to-peer network — spanning 50+ countries over nearly 20 years — underscored the global scale of Turla's operations.

Attribution & motivation

• Sponsor / nation: Russian Federation — Federal Security Service (FSB), Center 16. CISA has formally attributed Turla / Secret Blizzard to FSB Center 16. The 2023 joint FBI/CISA/NSA advisory (AA23-129A) detailed the Snake malware infrastructure and attributed it to FSB officers. The NSA/NCSC 2019 joint advisory documented Turla's hijacking of Iranian APT infrastructure and attributed it to the same FSB unit.
• Motivation: Primarily strategic intelligence collection (espionage) — diplomatic, military, political, and scientific intelligence aligned with Russian state interests. Turla is a pure espionage actor with no documented financially motivated or destructive campaigns; its sole objective is persistent, covert access to high-value targets for long-term intelligence gathering.
• Attribution confidence: High. Backed by U.S. DOJ court filings (Operation MEDUSA), joint CISA/NSA/FBI advisories, NSA/NCSC joint attributions, and consistent named vendor reporting (ESET, Kaspersky, Microsoft, Symantec/Broadcom, Palo Alto Unit 42, Mandiant, Cisco Talos, Accenture).

Targeting

• Sectors: Government and diplomatic bodies (especially ministries of foreign affairs, embassies); military and defense; education and research institutions; pharmaceutical companies; think tanks and NGOs; media.
• Regions: Primary focus on Europe (Eastern and Western — Germany, France, the Baltics, Balkans, Caucasus, Ukraine) and Central Asia. Significant targeting of Middle East, South Asia (via hijacked APT infrastructure), and NATO member states broadly. Operations documented in 50+ countries worldwide.