Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0010
MITRE ATT&CK Group

Turla (G0010)

IRON HUNTERGroup 88WaterbugWhiteBearSnakeKryptonVenomous BearSecret BlizzardBELUGASTURGEON
ShareXLinkedInRedditHN

[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)

▪Techniques used (68)

T1584.006Web ServicesT1112Modify RegistryT1069.001Local Groups

▪Software used (30)

S0029PsExectoolS0102nbtstattool
G0010 on MITRE ATT&CK →
T1140Deobfuscate/Decode Files or Information
T1588.002Tool
T1059.007JavaScript
T1134.002Create Process with Token
T1059.005Visual Basic
T1546.013PowerShell Profile
T1583.006Web Services
T1055.001Dynamic-link Library Injection
T1105Ingress Tool Transfer
T1555.004Windows Credential Manager
T1090Proxy
T1068Exploitation for Privilege Escalation
T1615Group Policy Discovery
T1049System Network Connections Discovery
T1106Native API
T1071.003Mail Protocols
T1021.002SMB/Windows Admin Shares
T1547.001Registry Run Keys / Startup Folder
T1005Data from Local System
T1012Query Registry
T1007System Service Discovery
T1110Brute Force
T1570Lateral Tool Transfer
T1189Drive-by Compromise
T1584.004Server
T1087.002Domain Account
T1685Disable or Modify Tools
T1564.012File/Path Exclusions
T1120Peripheral Device Discovery
T1567.002Exfiltration to Cloud Storage
T1102.002Bidirectional Communication
T1071.001Web Protocols
T1124System Time Discovery
T1087.001Local Account
T1204.001Malicious Link
T1090.001Internal Proxy
T1546.003Windows Management Instrumentation Event Subscription
T1560.001Archive via Utility
T1059.003Windows Command Shell
T1057Process Discovery
T1016System Network Configuration Discovery
T1587.001Malware
T1025Data from Removable Media
T1518.001Security Software Discovery
T1059.001PowerShell
T1027.010Command Obfuscation
T1059.006Python
T1213.006Databases
T1018Remote System Discovery
T1588.001Malware
T1069.002Domain Groups
T1027.011Fileless Storage
T1547.004Winlogon Helper DLL
T1553.006Code Signing Policy Modification
T1566.002Spearphishing Link
T1016.001Internet Connection Discovery
T1102Web Service
T1082System Information Discovery
T1584.003Virtual Private Server
T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
T1078.003Local Accounts
T1201Password Policy Discovery
T1083File and Directory Discovery
T1027.005Indicator Removal from Tools
S0126ComRATmalware
S0104netstattool
S0160certutiltool
S0363Empiretool
S0256Mosquitomalware
S1075KOPILUWAKmalware
S0581IronNetInjectortool
S1141LunarWebmalware
S0099Arptool
S0538Crutchmalware
S0022Uroburosmalware
S0393PowerStallionmalware
S0168Gazermalware
S0265Kazuarmalware
S0096Systeminfotool
S0395LightNeuronmalware
S0335Carbonmalware
S0002Mimikatztool
S0057Tasklisttool
S1142LunarMailmalware
S0039Nettool
S0075Regtool
S0537HyperStackmalware
S0091Epicmalware
S0590NBTscantool
S0668TinyTurlamalware
S0587Penquinmalware
S1143LunarLoadermalware

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.