Turla is one of the longest running cyber espionage operations on record, and its intrusions are built to stay hidden for years rather than days. Government advisories and MITRE ATT&CK attribute the group to Russia's Federal Security Service (FSB), and its tooling ranges from the kernel level Snake implant to Exchange transport agents, Outlook add-ins and small backup backdoors. This profile sets out the names, targeting, techniques and documented campaigns as the primary sources state them, then turns them into detection and defence work. It is for detection engineers, intelligence analysts and architects in government, diplomatic, defence, research and civil society organisations and their suppliers.
Key takeaways
- Attribution is unusually firm. A 2023 joint advisory from the FBI, NSA, CISA and Five Eyes partners attributes Snake operations to a known unit within Center 16 of the FSB, the same unit it links to the Turla toolset.
- Persistence is the defining trait. Turla keeps several layers of access at once, including small "second chance" backdoors such as TinyTurla, so removing one implant rarely ends an intrusion.
- Mail and network infrastructure are favoured hiding places. LightNeuron runs as a Microsoft Exchange transport agent, and Microsoft reported in 2025 that the group used an internet service provider level adversary-in-the-middle position against embassies in Moscow.
- The group borrows other actors' access. UK and US agencies and Microsoft have documented Turla taking over Iranian and Pakistan-based espionage infrastructure and riding cybercriminal botnets into Ukrainian military devices.
- Memory analysis, service auditing and credential rotation from clean systems are the core defences. The Snake advisory calls memory analysis the highest confidence detection method and tells victims to change credentials from a system the attacker cannot reach.
Who they are (names and aliases)
MITRE ATT&CK tracks Turla as group G0010 and describes it as "a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB)", active since at least 2004 with victims in more than 50 countries. The 2023 joint advisory on Snake (AA23-129A) places development of the Snake implant, originally named "Uroburos", in late 2003, with operations from around 2004. Microsoft tracks the actor as Secret Blizzard and states that CISA attributes it to FSB Center 16. For a different FSB-linked actor focused on credential phishing, see the Star Blizzard Threat Actor Profile.
| Name | Used by | Notes |
|---|---|---|
| Turla | MITRE ATT&CK (G0010), most vendors | Common public name; the joint advisory notes it is one of several open-source labels. |
| Snake, Uroburos | AA23-129A, MITRE (Uroburos S0022) | Names for both the group and its flagship implant. |
| Secret Blizzard | Microsoft | Microsoft lists overlaps with VENOMOUS BEAR, Uroburos, Snake, Blue Python, Turla, Wraith, ATG26 and Waterbug. |
| Venomous Bear | CrowdStrike (via MITRE) | Listed as an alias in G0010. |
| IRON HUNTER, Group 88, WhiteBear, BELUGASTURGEON | Other vendor naming (via MITRE) | Listed as aliases in G0010; scope of each overlap varies by vendor. |
| Waterbug | Symantec (via MITRE and Microsoft) | Listed in both alias sets. |
Vendors describe overlapping clusters, not identical ones, so record the source of each alias. See the Threat Actor Groups Guide for how naming schemes work.
Targeting and motivation
Every source reviewed describes intelligence collection, not financial or destructive aims.
- Government and diplomacy: ministries of foreign affairs, embassies and regional diplomatic organisations recur across ESET's LightNeuron research, Microsoft's 2025 report on foreign embassies in Moscow and the Snake advisory, which cites diplomatic documents taken from a NATO country.
- Military and defence: Microsoft reported Secret Blizzard prioritising devices linked to the Ukrainian military in 2024, including devices using Starlink IP addresses, and Indian military and defence institutions reached through compromised Storm-0156 infrastructure.
- Research, education and media: AA23-129A lists research facilities and journalists globally, and in the United States education, small businesses, media and critical infrastructure sectors including government facilities, financial services, critical manufacturing and communications.
- Civil society: Cisco Talos reported TinyTurla-NG against Polish non-governmental organisations in late 2023 and early 2024, including one supporting Ukraine.
Suppliers and small organisations near these targets are in scope too: AA23-129A lists US small businesses among victims.
Tactics and techniques (MITRE ATT&CK)
G0010 lists over 60 techniques; the table selects those with most defensive value. "Software" rows come from the malware entry, "our mapping" rows from the cited vendor report.
| Tactic | Technique | How sources describe Turla using it |
|---|---|---|
| Initial access | T1189 Drive-by Compromise; T1566.002 Spearphishing Link | Watering hole and spearphishing campaigns (MITRE G0010). |
| Initial access | T1557 Adversary-in-the-Middle (our mapping) | ISP level interception and captive portal redirection against diplomats in Moscow (Microsoft, 2025). |
| Execution | T1059.001 PowerShell; T1059.003 Windows Command Shell | TinyTurla-NG runs tasks through PowerShell or cmd.exe; PowerShell loaders across campaigns. |
| Persistence | T1505.002 Transport Agent (software: LightNeuron) | Malicious Exchange transport agent that reads, alters and blocks mail (ESET). |
| Persistence | T1547.004 Winlogon Helper DLL; T1546.003 WMI Event Subscription; T1546.013 PowerShell Profile | Listed in G0010 as persistence methods. |
| Persistence | T1136.001 Local Account (our mapping) | ApolloShadow creates a local administrator named UpdatusUser with a hardcoded password (Microsoft). |
| Defence impairment | T1553.004 Install Root Certificate (our mapping); T1685 Disable or Modify Tools | ApolloShadow installs two root certificates to intercept TLS; G0010 lists T1685. |
| Stealth | T1014 Rootkit (software: Uroburos); T1036.005 Match Legitimate Resource Name | Snake's kernel component; TinyTurla installed as "Windows Time Service" with w64time.dll. |
| Credential access | T1555.004 Windows Credential Manager; T1110 Brute Force; T1555.005 Password Managers (our mapping) | G0010 entries; Talos reports TinyTurla-NG scripts collecting password manager database key material. |
| Lateral movement | T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer | G0010, with PsExec and Mimikatz among listed tools. |
| Command and control | T1071.003 Mail Protocols; T1102.002 Bidirectional Communication; T1090.001 Internal Proxy; T1584.004 Server | Email based C2 and steganography (LightNeuron); compromised WordPress servers as C2 (TinyTurla-NG); Snake peer-to-peer relay network. |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage; T1560.001 Archive via Utility | G0010; TurlaPower-NG zips collected files before upload (Talos). |
For the underlying techniques see the Command and Control (C2) Guide and the Living off the Land Guide.
How they abuse identities and credentials
Turla is not primarily an identity attack group, but credentials and machine trust run through its tradecraft.
- Local administrator accounts: ApolloShadow creates a local administrator account with a hardcoded password and sets the network profile to Private with file sharing enabled. G0010 also lists T1078.003 Local Accounts. Unique rotated local admin passwords and alerts on new admin accounts counter this. See the Tiered Administration and Enterprise Access Model Guide.
- Trust stores as identity: installing attacker root certificates lets the group read TLS traffic in clear text, which exposes session cookies and credentials. Treat the machine and user certificate stores as identity configuration, and monitor them.
- Service identities and service installation: TinyTurla and TinyTurla-NG run as service DLLs under svchost.exe with names that mimic Windows services. A service inventory baseline turns these into anomalies.
- Stolen credentials re-used after cleanup: the Snake advisory tells victims to change credentials from a clean system and to avoid passwords similar to the old ones, because credentials captured during the intrusion outlive the implant.
- Password manager and credential stores: G0010 lists Windows Credential Manager theft, and Talos reports collection of password manager key material. See the Credential Dumping Guide.
- Other actors' access as a credential: the NCSC and NSA reported in 2019 that Turla exfiltrated an Iranian group's victim lists and credentials, and Microsoft reported in 2024 that it commandeered Storm-0156 backdoors and Amadey bots. An existing commodity infection is therefore a potential espionage entry point, not just hygiene.
Notable incidents
| Date (as published) | Activity | Source | Defensive lesson |
|---|---|---|---|
| May 2019 | LightNeuron Exchange transport agent backdoor, active since at least 2014, at a foreign ministry, a regional diplomatic organisation and a Brazilian victim | ESET | Audit Exchange transport agents; ESET notes the agent must be disabled before files are removed, or Exchange breaks. |
| October 2019 | Turla used Iranian Neuron and Nautilus implants and accessed Iranian C2, scanning for an ASPX web shell in at least 35 countries | NCSC with NSA | Attribution from tooling alone is fragile; the Iranian operators were almost certainly unaware. |
| September 2021 | TinyTurla backup backdoor in the US, Germany and Afghanistan | Cisco Talos | Look for regular beaconing (around every five seconds) and unknown services. |
| May 2023 | Joint advisory on Snake, infrastructure in over 50 countries; detection signatures and a Volatility 3 plugin published | FBI, NSA, CISA, CNMF, NCSC-UK, CCCS, ASD ACSC, NCSC-NZ | Use memory analysis and the published network and host detections; rotate credentials from clean systems. |
| February 2024 | TinyTurla-NG against Polish NGOs using compromised WordPress sites as C2 | Cisco Talos | Small organisations supporting policy goals are in scope. |
| December 2024 | Takeover of Storm-0156 infrastructure (Afghanistan, India) and use of Amadey bots and a Storm-1837 backdoor against Ukrainian military devices | Microsoft | Treat commodity infections on sensitive devices as potential espionage footholds; many targets had Defender disabled. |
| July 2025 | ApolloShadow delivered through ISP level AiTM against foreign embassies in Moscow | Microsoft | Tunnel all traffic from high risk locations to a trusted network; monitor root certificate installs. |
For a related profile see the APT29 (Midnight Blizzard) Threat Actor Profile.
Detection and defence
Detection signals
| Signal | Where to look | Why it matters for Turla |
|---|---|---|
| Kernel implant artefacts in memory | Memory images analysed with the Volatility 3 plugin from AA23-129A | The advisory rates memory analysis highest confidence because it bypasses Snake's concealment. |
| Custom HTTP, HTTP2 and TCP protocol patterns | Network IDS with the advisory's Suricata rules | Snake hides on legitimate listening ports, so port based rules miss it. |
| Host artefacts: covert store, registry blob, Queue File, comadmin.dat, disguised WerFault.exe | EDR file and registry telemetry, YARA, entropy checks | Published Snake host indicators. |
| New services and service DLLs under svchost.exe | Windows System log event 7045 and Security event 4697 (our selection); service inventory diff | TinyTurla and TinyTurla-NG install as services mimicking Windows names. |
| New or changed Exchange transport agents | Exchange configuration baseline (for example the Get-TransportAgent cmdlet output) | LightNeuron persists as a transport agent with spam filter level trust. |
| Root certificate installation and certutil use | Certificate store monitoring; EDR process telemetry | ApolloShadow installs root certificates; Microsoft lists "Suspicious root certificate installation" and "Suspicious certutil activity" alerts. |
| Local account creation and admin group changes | Security events 4720 and 4732 (our selection) | ApolloShadow creates an administrator account. |
| High frequency beaconing to low reputation or compromised sites | Proxy and DNS logs, NDR | TinyTurla checks for commands about every five seconds; TinyTurla-NG used compromised WordPress sites. |
| Endpoint protection disabled or tampered | EDR health and tamper protection reports | Microsoft found many targeted Ukrainian devices had Defender disabled. |
See the Memory Forensics Guide, the Sysmon Guide and the Windows Event Log Guide.
Phased defence plan
- Scope exposure (weeks 1 to 2): decide whether you sit in a targeted sector or supply one. Load G0010 techniques and the AA23-129A indicators into your threat intelligence platform with alias provenance.
- Close the easy footholds (weeks 2 to 6): enforce tamper protection and EDR block mode, remove standing local admin rights, deploy unique rotated local admin passwords, and turn on PowerShell script block and module logging as Microsoft recommends.
- Baseline high value servers (weeks 4 to 8): record Exchange transport agents, installed services, root certificates and scheduled persistence on mail servers, domain controllers and file servers. Alert on any drift.
- Deploy published detections in audit mode (weeks 6 to 10): run the Suricata and YARA content from the advisory and vendor hunting queries in alert only mode, tune false positives, then promote to production rules. Roll back by returning a rule to audit if it disrupts operations.
- Test memory forensics readiness (quarterly): capture and analyse memory from a pilot set of sensitive hosts, so the capability works before an incident.
- Plan the eviction: reset credentials from clean systems, map every persistence layer before removal, and disable Exchange agents before deleting them.
Choosing where to invest
- Small organisations and NGOs: managed EDR with tamper protection, MFA on all remote access and mail, and an always-on VPN for staff travelling to high risk countries give most of the benefit.
- Large government, diplomatic and defence estates: add in-house memory analysis, network detection on internal segments, configuration drift monitoring on mail infrastructure and dedicated hunting against G0010.
- Staff in hostile jurisdictions: Microsoft recommends routing all traffic through an encrypted tunnel to a trusted network, or a VPN provider not controlled by local parties. This matters most when the local ISP is the adversary.
Measuring it
- Telemetry coverage: percentage of servers and sensitive endpoints with EDR in block mode and tamper protection on.
- Configuration drift: number of unexplained new services, transport agents or root certificates per month, and median time to explain each.
- Local admin exposure: count of endpoints with standing local admin users and shared local admin passwords.
- Detection content health: share of AA23-129A rules deployed and tested.
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Threat intelligence intake on G0010 and advisories | SI-4 | ID.RA-02 |
| Host and memory monitoring, drift alerts | SI-4, AU-6 | DE.CM-09, DE.AE-02 |
| Network detection for custom protocols and beaconing | SC-7, SI-4 | DE.CM-01 |
| Remove local admin rights; unique credentials | AC-6, IA-2 | PR.AA-05 |
| Block unknown executables and services | CM-7, CM-11, SI-3 | PR.PS-05 |
| Eviction and clean-system credential reset | IR-4 | RS.AN-03 |
The mapping is NHI Mgmt Group's own; control IDs are verified against the official catalogues.
Common failure patterns
- Removing one implant and declaring victory: Turla's backup backdoors exist for exactly this case, so incomplete scoping returns the attacker within weeks.
- Resetting passwords from a compromised host: the Snake advisory says to change credentials from a clean system and to avoid new passwords similar to the old ones.
- Treating commodity malware as low priority on sensitive devices: Microsoft documented Amadey infections used to deliver Turla backdoors to military devices.
- No baseline for mail server extensions: a malicious transport agent looks like any other mail flow component unless someone has recorded what should be there.
- Relying on IOCs alone: infrastructure is frequently borrowed or compromised (WordPress sites, other actors' C2), so behaviour based detections age better than IP blocklists.
Practitioner checklist
- Map G0010 techniques and Secret Blizzard alerts into your detection coverage matrix and record alias sources.
- Deploy the AA23-129A Suricata and YARA content in audit mode, tune, then enforce.
- Confirm you can capture and analyse memory from a domain controller and a mail server within one day.
- Baseline Exchange transport agents, Windows services and trusted root certificates on critical servers and alert on change.
- Alert on new local accounts and additions to local Administrators groups.
- Enforce EDR tamper protection and investigate every device where protection was disabled.
- Require an always-on tunnel to a trusted network for staff working from high risk jurisdictions.
- Write clean-system credential rotation and full persistence mapping into the incident response plan.
Standards and references
- CISA, FBI, NSA and partners: Hunting Russian Intelligence "Snake" Malware (AA23-129A)
- MITRE ATT&CK: Turla (G0010)
- NCSC: Turla group exploits Iranian APT to expand coverage of victims
- Microsoft Threat Intelligence: Secret Blizzard's AiTM campaign against diplomats
- Microsoft Threat Intelligence: Secret Blizzard compromising Storm-0156 infrastructure for espionage
- Microsoft Threat Intelligence: Secret Blizzard using tools of other groups to attack Ukraine
- ESET Research: Turla LightNeuron, an Exchange transport agent backdoor
- Cisco Talos: TinyTurla Next Generation
Related NHI Mgmt Group resources: Threat Actor Groups Guide · APT28 (Fancy Bear) Threat Actor Profile · Sandworm Threat Actor Profile · MuddyWater Threat Actor Profile · Threat Intelligence Guide