APT Profile – Turla
Cyber Espionage Under the Radar Since 1996
- 21 December 2022
- Zettl-Schabath, Kerstin; Gschwend, Timothy; Borrett, Camille
- EN
About Turla
Turla is possibly a state-integrated group (civil intelligence service/agency members). Private threat intelligence companies, such as Talos Intelligence, designated Turla as a “state-sponsored” actor. As noted with respect to the Five Eyes Joint Cybersecurity Advisory, public reporting on the degree of proximity to Russian state entities, particularly the FSB, differs. Unlike other Russian groups, such as Fancy Bear, Cozy Bear, Sandworm, or Energetic Bear, which government and industry reports alike have linked to Russian government agencies, open-source material leaves the question of the institutional sponsorship of Turla open to further corroboration. A German media report published in February 2022 presented evidence for the Turla-FSB connection, identifying two former Turla programmers that worked at the Russian company Center-Inform, which officially operates on behalf of the FSB.
Associated APT designations
- Turla (Kaspersky)
- Venomous Bear (CrowdStrike)
- Snake (BAESystems)
- Uroburos (G DATA)
- MAKERSMARK (CSE)
Country of origin
Period of activity
2004-today
More APT profiles
- Research and Analysis