aol.pm

Turla

IntrusionSet · ATTACK:enterprise:G0010

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0010",
  "title": "Turla",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0010",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--7a19ecb1-3c65-4de3-a230-993516aed6a6",
  "external_id": "G0010",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:49.816Z",
  "modified": "2026-07-31T18:48:02.956Z",
  "version": "5.1",
  "aliases": [
    "Turla",
    "IRON HUNTER",
    "Group 88",
    "Waterbug",
    "WhiteBear",
    "Snake",
    "Krypton",
    "Venomous Bear",
    "Secret Blizzard",
    "BELUGASTURGEON"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "BELUGASTURGEON"
    },
    {
      "source_name": "Krypton"
    },
    {
      "source_name": "Snake"
    },
    {
      "source_name": "Venomous Bear"
    },
    {
      "source_name": "Turla"
    },
    {
      "source_name": "Group 88"
    },
    {
      "source_name": "Secret Blizzard"
    },
    {
      "source_name": "IRON HUNTER"
    },
    {
      "source_name": "Accenture HyperStack October 2020",
      "url": "https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"
    },
    {
      "source_name": "Waterbug"
    },
    {
      "source_name": "Talos TinyTurla September 2021",
      "url": "https://blog.talosintelligence.com/2021/09/tinyturla.html"
    },
    {
      "source_name": "ESET Turla Mosquito Jan 2018",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
    },
    {
      "source_name": "ESET Gazer Aug 2017",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
    },
    {
      "source_name": "ESET Turla PowerShell May 2019",
      "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
    },
    {
      "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
      "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
    },
    {
      "source_name": "Securelist WhiteBear Aug 2017",
      "url": "https://securelist.com/introducing-whitebear/81638/"
    },
    {
      "source_name": "Kaspersky Turla",
      "url": "https://securelist.com/the-epic-turla-operation/65545/"
    },
    {
      "source_name": "Leonardo Turla Penquin May 2020",
      "url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
    },
    {
      "source_name": "CrowdStrike VENOMOUS BEAR",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Secureworks IRON HUNTER Profile",
      "url": "http://www.secureworks.com/research/threat-profiles/iron-hunter"
    },
    {
      "source_name": "Symantec Waterbug",
      "url": "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1"
    },
    {
      "source_name": "WhiteBear"
    }
  ]
}

Explicit source assertions (98)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1584.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b5af07-512b-4b60-ba2d-5c185b80fb5f

Recorded Future Turla Infra 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052be04b-5ff3-4757-a5c1-de012997accc

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--059cc1e2-9570-4760-8137-d3d71b66bb78

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07516f04-c7aa-46c7-9cca-0f81b84043e2

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08fccacb-803c-4d00-baa7-ed6af83660ae

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b512662-8eb8-424d-99c5-4f76d1d70276

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c4e4578-3bb1-4c9a-9dc8-af3b7368ada9

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1134.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ebd9fb8-a6d0-4b91-bada-c5e5c79b0808

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13ac3b6b-d008-44fa-88c3-53d0927961d2

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1546.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18983529-5998-4f76-be90-f6e9cdd9f33d

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1583.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a51277b-0f14-4d8a-88cb-6616da7b4a98

ESET Crutch December 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a978832-f04d-4853-8094-58fc99e30ed1

ESET Turla Mosquito May 2018 · Github Rapid7 Meterpreter Elevate

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ab3f63b-bd80-4e4c-8f62-79f26b9724ab

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b90b04-4ce1-4e9a-9dbb-9fc93569d3e1

ESET Turla Mosquito May 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1555.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2188382d-d557-4a81-9713-7ef4cc675e76

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e162cdf-e917-4bc5-a2d2-1623e05d0b61

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3185e611-cec6-4910-aa64-efd8fafe1072

Unit42 AcidBox June 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1615

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33214d7f-0c78-4905-8ab0-8a6b6eb20eeb

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3325e625-d76b-42df-b952-749dabb57517

Kaspersky Turla · ESET ComRAT May 2020 · ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3465231b-93b2-47ea-8c4f-f1f7e9d9be1b

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0126

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35a9c64c-c305-46bf-a216-c8bb1b051614

Unit 42 IronNetInjector February 2021 · Secureworks IRON HUNTER Profile · Symantec Waterbug

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3632ab1c-caa3-4d65-a665-7da325f4b7ac

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3643f451-322d-4f38-91a4-00a55a42c7f5

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f14542-1dd2-4b2e-b69f-d7f38ea9800e

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40848159-b266-42df-9cf8-785b2f78bcfc

ESET Turla August 2018 · ESET Crutch December 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0256

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43e9c37e-9e57-4130-8510-05c65bfde6f8

ESET Turla Mosquito Jan 2018 · ESET Turla Mosquito May 2018 · Secureworks IRON HUNTER Profile

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a6248d4-4fa1-404a-abed-84e9b7c32dbe

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2450a7-d2d2-4063-9dd5-cac396a3215c

ESET Turla Mosquito May 2018 · ESET Turla Mosquito Jan 2018 · ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--500c4228-b676-4f47-a391-9e52abd5ea51

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--519c4c7f-8495-4b8a-b58e-551a78e469cc

Kaspersky Turla · ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52c18ed1-91a5-4394-a4d0-f700c75bf3d9

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S1075

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54b38c51-b6b3-4d8a-9e6f-f257a3543939

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0581

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5543599a-779f-4955-8f3e-99cc92b1e2fc

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S1141

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55eae56f-41d3-4480-8b5b-0d7794e5c75e

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5682d524-80f0-4fd8-9960-6f54eeafce96

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56ad8893-2933-4b3b-a84d-026d9afb7dcb

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0099

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c0645e4-f0c7-4bb4-bedb-29a96a472fe0

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e8f23be-48b6-4236-9475-89f11e769ee6

ESET ComRAT May 2020 · Secureworks IRON HUNTER Profile

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1584.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65eac98e-82b8-4592-a121-bea99f80dc87

Accenture HyperStack October 2020 · Talos TinyTurla September 2021 · Recorded Future Turla Infra 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0538

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--686d91dc-692b-48a0-829b-2556c6415f59

ESET Crutch December 2020 · Talos TinyTurla September 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--689d5a99-cfcf-43d6-ae55-9bf920986f63

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0022

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a87ff58-10b1-4fbc-a633-d7d8a34d1b29

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e067a3e-21a7-4a68-ac82-60b7ea325a5d

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1564.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73d8a610-1fe1-40bc-82ba-52129d8c4979

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0393

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76428147-d359-4568-a1a2-7cc3da632da4

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0168

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--773e99eb-0739-42d3-afaa-aff65e86329d

ESET Gazer Aug 2017

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0265

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--775d3c82-5863-43fa-8dfd-2f62382d53f1

Unit 42 Kazuar May 2017 · Talos TinyTurla September 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dd2714d-aa8a-40ce-bae1-98634090ac01

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dda2468-0344-48c5-8843-6655084d8159

Symantec Waterbug Jun 2019 · ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fcd4b9b-87e3-4e8c-abde-84639c85467f

ESET Turla Mosquito Jan 2018 · ESET Turla Mosquito May 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--825aded7-3c93-47ec-9ba5-5bd5af4e2e2b

ESET Turla Mosquito Jan 2018 · ESET Turla Mosquito May 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87b74ba7-99c4-464c-86d2-1dd8c8b578b1

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a47e81d-be1f-488c-8136-40e18c70d45f

ESET ComRAT May 2020 · ESET Crutch December 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8be8b96b-b69c-497a-8b38-308b8bd291ff

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0096

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cdfc8e4-b657-4ae9-b9ee-9b6107fae796

ESET Turla Lunar toolset May 2024 · Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eafddf4-a5ae-43a0-8129-966de05fefb0

Talos TinyTurla September 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1546.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9263ab45-f7d5-4bcf-af7e-d7be1913c3d6

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--931c0864-0b91-46b7-bdc0-0360777d95a6

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9850f990-17ed-40f5-8065-a455f1198404

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dfb7899-20af-4eea-bfca-f608d885cb00

Kaspersky Turla · ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9eefeafd-aca1-4e4c-8d29-ea6f9154808a

Kaspersky Turla · Symantec Waterbug Jun 2019 · ESET ComRAT May 2020 · ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0395

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4d6544d-0d01-4cdd-81e8-4b6382675f10

ESET LightNeuron May 2019 · Secureworks IRON HUNTER Profile

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8cfb738-65ac-4d5a-8ef7-d3a21eab02ea

Recorded Future Turla Infra 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad2efb21-6884-422f-8e89-fc0b1d2dcbb0

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad8d3784-2eea-47b4-b13d-d16d0211acf3

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ada9885f-276a-4f97-859d-1bb9f73b58c1

ESET Turla Mosquito May 2018 · ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae6620d4-5320-4e5a-a61a-5bda4ac1c9e4

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afea3455-9565-4e5d-b431-e845ec1722d2

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0335

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2b885e0-3b49-4a38-80eb-30a1a3157ff0

ESET Carbon Mar 2017 · Secureworks IRON HUNTER Profile

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1213.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3e2abaa-f431-4791-95d0-d44f3a74a73f

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8a1739d-240b-46c1-a25a-b82d1c4e4765

Kaspersky Turla · ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9c05069-a05f-4b74-9b4d-275c64f2e124

ESET Turla Mosquito May 2018 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba6536dd-2c36-4057-bae9-e71e1076e69b

Recorded Future Turla Infra 2020 · NSA NCSC Turla OilRig

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcd2cfa1-793c-40a7-9920-614539e651a7

ESET ComRAT May 2020

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd2a23f7-88cd-47d2-b30e-9356d0204a8e

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd437a82-65df-42d7-a73b-6ed63a4cdd63

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S1142

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9999f59-6d9a-4f06-ba4f-df7590bcd366

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd79beea-20ee-4b4f-aad1-5cc34d27398c

Kaspersky Turla

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1547.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce9c90e9-d408-485e-a380-52a87abcf3fc

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0075

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0ed3128-67f0-43dd-b1d9-01843eb71b77

Kaspersky Turla

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.