Turla | Threat Actor Profiles

Overview

Turla is one of the oldest and most sophisticated Russian cyber espionage groups, attributed to the FSB's Center 16. Active since the mid-1990s, the group is known for its innovative techniques including satellite-based C2, hijacking other threat actors' infrastructure, and deploying rootkits. Turla's Snake malware network was dismantled by the FBI in 2023 via Operation MEDUSA, but the group continues to develop new capabilities.

Tools & Malware

Snake/UroburosCarbonKazuarComRATLightNeuronGazerCrutchTinyTurlaCapibarDeliveryCheckSnake Malware AdvisoryChisel

Malware & Tool Details

Arsenal attributed to Turla.

Attack Path Operation MEDUSA / Snake P2P

Following MITRE ATT&CK Flow methodology.

ATTACK FLOWOperation MEDUSA / Snake P2P8 steps | Drag nodes to rearrange

Diamond Model

Caltagirone, Pendergast & Betz (2013) | Drag to rearrange

ADVERSARY

FSB Center 16, operators in Ryazan, Russia. Snake active since 2003.

CAPABILITY

Snake/Uroburos rootkit, Carbon, Kazuar, ComRAT, LightNeuron, TinyTurla, Gazer

INFRASTRUCTURE

Global P2P Snake relay (50+ countries), hijacked satellite links, compromised embassies

VICTIM

Government/diplomatic in 50+ countries, NATO, US DoD, European foreign ministries

ATT&CK Navigator

Interactive MITRE ATT&CK Navigator layer for Turla (G0010).

Loading ATT&CK Navigator...

Open Full Navigator

Known CVEs Exploited

CVE	Year	Description
CVE-2013-5065	2013	Windows NDProxy.sys privilege escalation
CVE-2014-1761	2014	Word RTF RCE via spearphishing
CVE-2022-30190	2022	Follina MSDT RCE in Ukraine campaigns

Notable Campaigns

2023

Operation MEDUSA

FBI disruption of Snake malware P2P network spanning 50+ countries.

2020

Iron Tiger/OilRig Hijack

Hijacking of Iranian APT infrastructure for own espionage operations.

2015

Satellite C2

First known use of satellite internet links for covert C2 communications.

2008

Agent.BTZ / Buckshot Yankee

Compromise of classified US military networks via USB worm.

Detection Engineering

Snake Rootkit Detection

Monitor for unsigned kernel drivers via Sysmon Event ID 6 (Driver Loaded). Detect named pipe patterns used by Snake (e.g., \\.\pipe\isarpc*). Deploy kernel integrity monitoring tools. The FBI released the PERSEUS tool specifically designed to detect and neutralize Snake installations.

View Detection Rule / Guide

LightNeuron Exchange Backdoor

Audit Exchange TransportAgent registry entries for unknown DLL assemblies. Monitor for emails being silently forwarded, modified, or blocked by transport rules not created by administrators. Check IIS logs for anomalous Exchange Web Services activity.

View Detection Rule / Guide

Infrastructure Hijacking Detection

Monitor for unexpected changes in DNS resolution for known C2 infrastructure of other threat actors. Turla has documented history of hijacking OilRig/APT34 C2 servers. Deploy DNS monitoring for infrastructure changes in threat intel feeds.

View Detection Rule / Guide

Related Threat Actors

Documented in MITRE ATT&CK, vendor intelligence, and government advisories.

Defense Recommendations

Mitigations with MITRE ATT&CK IDs. Click badges for implementation guidance.

Deploy kernel integrity monitoring. Turla Snake operates at kernel level and evades standard EDR.

CISA AA23-129A

Audit Exchange transport agents. Remove non-Microsoft agents. LightNeuron installs as transport agent.

ESET LightNeuron

Implement strict egress filtering. Allow only known protocols/destinations.

NIST SP 800-41

Review all mitigations in CISA AA23-129A for Snake malware detection and removal.

CISA/FBI Advisory

Attribution Confidence

High

Attribution
Confidence

Evidence Supporting Attribution

FBI/CISA Snake malware attribution to FSB Center 16

https://www.cisa.gov/news-events/cybersecurity-advisories/aa

DOJ disrupts Snake network via Operation MEDUSA

https://www.justice.gov/opa/pr/justice-department-announces-

ESET, Kaspersky, Symantec long-term tracking

https://securelist.com/the-epic-turla-operation/65545/

Threat Assessment

Capability10/10

Intent8/10

Targeting8/10

Critical

Overall Threat Level

Most technically sophisticated espionage actor. Kernel rootkit capability (Snake), satellite C2, and documented infrastructure hijacking of other APT groups.

Legal Actions & Sanctions

2023-05

DOJ/FBI disrupts Snake malware network via Operation MEDUSA

Disruption

https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled

Recent Reporting

2023-05

FBI/CISA: Snake malware network disrupted

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

Emulation Plans & Guidance

Plan	Source	Type	Description	Link
MITRE CTID - Turla Full Emulation Plan	MITRE CTID	Open Source	Complete Turla emulation with Carbon and Snake P2P operations	Open
ATT&CK Evaluations - Turla Round 5	MITRE Engenuity	Framework	Official evaluation featuring Turla Carbon and Snake toolset	Open
CISA Snake Malware Advisory	CISA/FBI	Guide	Technical advisory with detection guidance for Snake rootkit	Open
ATT&CK Evaluations - Turla Round 5	MITRE Engenuity	Framework	Official Round 5 evaluation with Carbon backdoor and Snake rootkit emulation scenarios	Open
MITRE CTID - Turla Emulation Plan	MITRE CTID	Open Source	Step-by-step Carbon and Snake P2P operations with detection and protection scenarios	Open
Hunting Russian Intelligence Snake Malware (CISA AA23-129A)	AttackIQ	Blog Post	Attack graph response emulating Snake rootkit behaviors from CISA/FBI joint advisory	Open

References & Intelligence Sources

CISA AA23-129A: Snake Malware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
MITRE ATT&CK Group G0010
https://attack.mitre.org/groups/G0010/
ESET: Turla LightNeuron
https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/
Kaspersky: Turla/Uroburos Operations
https://securelist.com/the-epic-turla-operation/65545/
DOJ: FBI Disrupts Snake Malware Network
https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled
Symantec: Waterbug/Turla Arsenal
https://symantec-enterprise-blogs.security.com/threat-intelligence/waterbug-espionage-governments
Malpedia: Turla
https://malpedia.caad.fkie.fraunhofer.de/actor/turla_group
ESET Turla IOCs
https://github.com/eset/malware-ioc/tree/master/turla
MITRE ATT&CK G0010
https://attack.mitre.org/groups/G0010/
CISA AA23-129A Snake Malware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
DOJ Operation MEDUSA
https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled
ESET Turla Research
https://github.com/eset/malware-ioc/tree/master/turla
Kaspersky Epic Turla
https://securelist.com/the-epic-turla-operation/65545/

Page Contributors

Adversary Village

GitHub Twitter LinkedIn

MITRE ATT&CK Team

GitHub Twitter LinkedIn

BreachSimRange

GitHub Twitter LinkedIn