Threat actor · all actors

TurlaG0010 state

aka Turla, IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON, WRAITH, Uroburos, Pfinet, TAG_0530, Hippo Team, Pacifier APT, Popeye, SIG23, MAKERSMARK, ATK13, G0010, ITG12, Blue Python, SUMMIT, UNC4210, UAC-0144, UAC-0024, UAC-0003

Last updated: 2026-07-03

0attributed CVEs

92ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	51 / 92	55%
`CM-6`	45 / 92	49%
`CM-2`	39 / 92	42%
`SI-3`	38 / 92	41%
`AC-6`	33 / 92	36%
`CM-7`	32 / 92	35%
`CA-7`	31 / 92	34%
`AC-3`	30 / 92	33%
`AC-2`	27 / 92	29%
`SC-7`	23 / 92	25%
`SI-7`	20 / 92	22%
`AC-4`	19 / 92	21%
`SI-2`	17 / 92	18%
`CM-5`	16 / 92	17%
`SI-10`	15 / 92	16%

Co-occurring actors

None.

Similar actors

Similar TTPs

Same nation-state

Operation Ghost 1.00
SolarWinds Compromise 1.00
2016 Ukraine Electric Power Attack 1.00
2015 Ukraine Electric Power Attack 1.00
Triton Safety Instrumented System Attack 1.00