APT PROFILE – TURLA GROUP

Turla is a Russia-linked advanced persistent threat (APT) group that has been active since at least 2008 and is widely assessed to conduct long-term cyber espionage operations in support of Russian strategic intelligence objectives. The threat actor is known for targeting government institutions, diplomatic entities, military organizations, and other high-value networks to obtain sensitive political, military, and strategic intelligence. The threat actor employs sophisticated malware, covert persistence mechanisms, and encrypted command-and-control (C2) infrastructure to maintain long-term access while minimizing detection. The group has demonstrated advanced operational security practices, including the use of custom toolsets, stealthy surveillance techniques, and encrypted communications, making attribution and analysis particularly challenging. The threat actor continues to refine its tradecraft and remains one of the most capable and persistent state-sponsored cyber espionage groups.

Alias: Group 88, Iron Hunter, Krypton, Sig23, Summit, Secret Blizzard, Snake, Turla, Turla Team, UAC-0194, Uroburos, Venomous Bear, Waterbug.

Motivation: Espionage

Targeted Industries:

Targeted Countries:
Belarus, France, Germany, India, Iran, Iraq, Italy, Kazakhstan, Netherlands, Poland, Romania, Russia, Russian Federation, Saudi Arabia, Switzerland, Tajikistan, Ukraine, United States, Uzbekistan.

Target Technologies:
Office Suites Software, Operating System, Web Applications, Windows.

Malware used by Turla Group:
Uroburos, Comrat, Epic, Stockstay Backdoor, Kazuar, Carbon, Wildday, Lightneuron, Apolloshadow, Mosquito, Diamondback, Powerstallion, Gazer, and Tinyturla-NG.

ATTACK FLOW DIAGRAM OF APT THREAT ACTOR TURLA GROUP

Turla Group’s Recent Campaign Highlights and Trends

Recent Campaign Highlights

• April–June 2026 – Expansion Across Strategic Technology and Enterprise Environments: The CYFIRMA Research team identified Turla as a Russia-linked cyber-espionage group targeting government, diplomatic, defence, research, and technology organizations. The group’s activities involved attempts to compromise email and communication systems, enterprise networks, VPN and proxy infrastructure, operating systems, web applications, and other internet-facing technologies. This activity highlights Turla’s continued focus on gaining access to organizations that hold sensitive or strategically valuable information.
• July 2026 – STOCKSTAY Backdoor Activity: CYFIRMA reported Turla’s suspected use of the STOCKSTAY backdoor against government organizations, Western foreign ministries, and defence entities in Ukraine and Italy. The campaign appeared to be primarily focused on cyber-espionage and intelligence collection, with the attackers seeking to maintain long-term access to compromised networks and gather sensitive information.
• July 2026 – French Entities Targeted Using the Turla Intrusion Set: In July 2026, researchers reported a Turla intrusion campaign targeting and compromising French organizations. The affected entities included organizations and ministries associated with the diplomatic, defence, justice, and technology sectors. The activity demonstrates Turla’s continued interest in European organizations, particularly those involved in government operations, national security, and strategic technologies.

Trends

Expansion of Long-Term Cyber-Espionage Operations

Turla continues to prioritize strategic cyber-espionage campaigns focused on intelligence collection rather than disruptive or destructive operations, demonstrating a sustained commitment to long-term access.

Continued Evolution of Malware Capabilities
The actor regularly enhances its malware ecosystem by introducing improved persistence mechanisms, defense-evasion techniques, encrypted communications, and modular functionality to maintain operational effectiveness.

Growing Emphasis on Stealth and Operational Security
Recent campaigns demonstrate increased use of living-off-the-land techniques, legitimate administrative utilities, fileless execution methods, and carefully managed command-and-control communications to reduce forensic visibility.

Expansion Across Strategic Sectors
While government and diplomatic organizations remain primary targets, Turla has also expanded its focus toward defense contractors, telecommunications providers, technology companies, research organizations, aerospace entities, and critical infrastructure.

Abuse of Trust Relationships and Legitimate Infrastructure
The group increasingly exploits trusted relationships, legitimate software, cloud platforms, and compromised infrastructure to facilitate covert access and minimize detection throughout the intrusion lifecycle.

Strategic Pre-Positioning within High-Value Networks
Rather than pursuing immediate objectives, Turla frequently establishes long-term footholds within strategically important environments, enabling continuous intelligence collection and rapid operational access when required.

TTPs based on MITRE ATT&CK Framework