Turla (aka Uroboros, Snake) threat actor

Turla is a Russian nation-state cyber espionage group attributed to Russia's Federal Security Service (FSB). Active since at least 2004, with some assessments linking it to intrusions going back to the late 1990s, it has compromised organizations in more than 50 countries and concentrated consistently on foreign ministries, embassies, defense organizations, military bodies, research institutions, and pharmaceutical companies. Turla is one of the longest-running and most technically capable espionage groups on record, known for building its own malware rather than relying on commodity tools, and for tradecraft that other actors rarely attempt. The group is tracked under a long list of names, most commonly Snake, Uroburos, Waterbug, and Venomous Bear, and MITRE ATT&CK catalogs it as G0010. This page covers Turla's aliases and attribution, who it targets, how it operates, what makes its tradecraft distinctive, and how organizations defend against it, drawing in part on first-party research by Sekoia's Threat Detection & Research (TDR) team.

Key takeaways

Turla is attributed to Russia's FSB. It conducts long-term espionage aligned with Russian intelligence priorities, and the attribution is supported by joint government advisories and a 2023 international disruption operation.
It has many names. Snake, Uroburos, Waterbug, Venomous Bear, Krypton, and Secret Blizzard all refer to the same actor, tracked by MITRE as G0010.
Its targets are diplomatic and military. Foreign ministries, embassies, defense organizations, and research institutions across more than 50 countries.
It builds its own malware. The group has maintained a family of in-house implants for two decades, including the Uroburos rootkit that gave it one of its names.
Its tradecraft is unusual. Turla hides command and control inside legitimate cloud services and has taken over infrastructure and tools belonging to other threat actors.

Turla's other names

Turla has been tracked independently by many research teams over two decades, which is why it carries an unusually long list of designations. They all point to the same actor: Snake, Uroburos (also written Uroboros), Waterbug, Venomous Bear, Krypton, Secret Blizzard, IRON HUNTER, Group 88, WhiteBear, BELUGASTURGEON, Pensive Ursa, and G0010 (MITRE ATT&CK).

Two points are worth clarifying when reading across sources. First, Snake and Uroburos are the names of the group's flagship rootkit, and the group is frequently referred to by its malware rather than by a separate label, so the same word can mean either the tool or the actor depending on context. Second, WhiteBear describes a cluster of activity that overlaps with Turla but appears to have had a distinct focus, so some reporting treats it as a subset rather than a straight synonym.

Attribution

Turla is attributed to the FSB, Russia's Federal Security Service. The attribution rests on two decades of targeting aligned with Russian intelligence requirements, consistent use of in-house malware, and analysis published by government agencies alongside the wider research community. Joint advisories from Western cybersecurity authorities have documented the group's tooling in detail, and in 2023 an international operation disrupted the network of machines running its Snake implant, accompanied by government statements naming the FSB unit responsible.

The group's origins are dated differently depending on the source. MITRE ATT&CK records activity since at least 2004, while some assessments, including Sekoia's own, connect Turla to intrusions going back to the late 1990s, notably the Moonlight Maze campaign against United States networks between 1996 and 1999, and to the Agent.BTZ worm that spread through sensitive US defense networks in 2008. What isn't disputed is the continuity: the same group has been operating, evolving, and rebuilding its toolset for a very long time.

Who Turla targets

Turla's targeting is diplomatic and military first, and it maps closely onto Russian foreign policy interests:

Ministries of foreign affairs and embassies: the group's most consistent focus across its entire history.
Defense organizations and military bodies, including allied and NATO-affiliated institutions.
Government administrations, across Europe, the former Soviet space, the Middle East, and beyond.
Research and higher education, particularly institutions working on defense and strategic policy.
Telecommunications and pharmaceutical companies, alongside other private organizations holding information of strategic value.

The group has affected organizations in more than 50 countries. Sekoia's own investigation, described below, found Turla infrastructure prepared for use against a Baltic defense education institution, an Austrian body with a formal role in national decisions on economic sanctions, and a NATO e-learning platform, illustrating precisely how the targeting follows political and military intelligence requirements.

How Turla operates

Turla combines patient, silent intrusion with genuine engineering capability. Its activity maps onto the MITRE ATT&CK framework.

Stage	Representative techniques
Initial access	Spearphishing with malicious links, and watering hole compromises that infect visitors to websites the intended targets are known to use.
Execution & persistence	Heavy use of PowerShell, including payloads stored in the registry rather than on disk, plus persistence through WMI event subscriptions, PowerShell profiles, and registry autostart keys.
Defense evasion	Bypassing the Windows Antimalware Scan Interface, exploiting a vulnerable driver to obtain kernel privileges and disable driver signature enforcement, and stripping identifiable strings from its own malware.
Command & control	Legitimate web services used as channels, including cloud storage, code hosting, and paste sites, alongside compromised websites and servers.
Collection & exfiltration	Credential theft, internal network reconnaissance with built-in Windows commands, collection from removable media, and exfiltration of archived data to cloud storage.

The group has maintained a family of in-house implants across its lifetime, including the Uroburos rootkit, ComRAT, Carbon, Crutch, Gazer, the Mosquito toolset, the lightweight TinyTurla backdoor, and more recently the Lunar backdoors observed against diplomatic missions. Turla also picks up publicly available tooling when it suits, customizing well-known credential-dumping and post-exploitation frameworks rather than writing everything from scratch.

What makes Turla's tradecraft distinctive

Several characteristics set this group apart, and they're worth knowing because they shape how it can be detected.

It hides command and control in services you can't block. Turla has routed communications through cloud storage, code repositories, paste services, and even a cloud scripting platform. Traffic goes to a domain the organization uses legitimately, which defeats detection based on unfamiliar infrastructure.

It takes over other actors' infrastructure and tools. Government reporting has documented Turla using servers belonging to a compromised Iranian threat group and repurposing malware obtained from other actors. This complicates attribution for anyone analyzing an intrusion, because the artifacts point somewhere else.

It operates at the kernel. The Uroburos rootkit and later tooling worked at a depth most groups don't attempt, which historically made the implants hard to find with standard endpoint tools.

It sometimes collects intelligence without deploying malware at all. As Sekoia's research below shows, a Turla operation can consist of nothing more than a document that calls home without the reader noticing, with no malicious code to detect.

Sekoia's research on Turla

Sekoia's TDR team investigated Turla infrastructure in 2022, publishing findings that had first been delivered to clients as a Flash Intelligence report. Starting from publicly reported domains, the team expanded the investigation and uncovered further attacker infrastructure built on typosquatted domains impersonating three specific institutions: the Baltic Defence College, a strategic military education center founded by Estonia, Latvia, and Lithuania; the Austrian Federal Economic Chamber, a body that Austrian governments are legally required to consult on regulation including economic sanctions; and a NATO e-learning platform used by military and government personnel.

The most significant finding was what the documents actually did. Each hosted file looked like a legitimate briefing document and contained no malicious code. Instead, it referenced an external image over the web, so that simply opening it caused the document to call back to the attacker's server. That single request revealed which version of the word processor the target was running, useful for selecting a tailored exploit later, and disclosed the target's network address, a valuable selector for an intelligence service with signals intelligence capability. Pure reconnaissance, deliberately built to leave nothing for malware detection to find. Sekoia published detection rules and indicators of compromise alongside the analysis.

How to defend against Turla

Because Turla favors legitimate services and quiet techniques over noisy malware, effective defense combines prevention with behavioral monitoring:

Harden against phishing and watering holes. Email filtering, user awareness, and scrutiny of documents that reach out to external resources close the group's main routes in.
Monitor use of legitimate cloud services. Because command and control hides inside services an organization genuinely uses, watch for anomalous patterns of access rather than relying on domain reputation.
Enable and monitor PowerShell and script logging. Script block logging and monitoring for obfuscated commands surface a technique the group depends on heavily.
Watch the persistence mechanisms it favors. Alert on new WMI event subscriptions, modified PowerShell profiles, unexpected autostart entries, and payloads written into the registry.
Control driver loading and removable media. Blocking vulnerable drivers limits kernel-level escalation, and restricting execution from removable devices addresses a collection route the group has used.
Hunt behaviorally, with current intelligence. Turla rebuilds its toolset regularly, so tracking its techniques and infrastructure patterns matters more than matching known files.

Expert insight: Patient espionage is caught by context, not signatures

Turla has operated for twenty years not because it has a single unbeatable capability, but because the group works hard to look like nothing. A document that fetches an image. A script that runs through a built-in Windows utility. An upload to a cloud storage service the organization uses every day. Examined one at a time, each of these events is unremarkable, and that is the design. Detection that asks only whether a file is known to be malicious will find very little to report on a Turla intrusion.

Correlation and intelligence have to work together. Sekoia is a European cybersecurity vendor whose in-house TDR team has investigated Turla directly, mapping its infrastructure and turning what it found into detection rules and shared indicators. That research feeds the Sekoia AI SOC platform, where signals from endpoint, network, identity, and cloud are correlated and matched against rules mapped to MITRE ATT&CK, so a sequence, a document reaching out, a scripting host launching, an unusual upload to a familiar service, is recognized as one intrusion rather than three unrelated events.

For the foreign ministries, defense organizations, and research institutions this group targets across Europe, the fact that a European vendor with a data-sovereignty posture processes that telemetry is not a minor detail. The useful question is never only whether a file is malicious. It's why this document contacted an external server, why that process is running a script, and why this account is uploading data at this hour. Answering those questions requires visibility across the whole environment, read against current intelligence on how the group works.