Turla G0010

Overview 325 indicators

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.

Techniques 68 ATT&CK

Open in ATT&CK Navigator → or download the layer (68 techniques, layer 4.5)

• T1005 Data from Local System
• T1007 System Service Discovery
• T1012 Query Registry
• T1016 System Network Configuration Discovery
• T1016.001 Internet Connection Discovery
• T1018 Remote System Discovery
• T1021.002 SMB/Windows Admin Shares
• T1025 Data from Removable Media
• T1027.005 Indicator Removal from Tools
• T1027.010 Command Obfuscation
• T1027.011 Fileless Storage
• T1036.005 Match Legitimate Resource Name or Location
• T1049 System Network Connections Discovery
• T1055 Process Injection
• T1055.001 Dynamic-link Library Injection
• T1057 Process Discovery
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1059.006 Python
• T1059.007 JavaScript
• T1068 Exploitation for Privilege Escalation
• T1069.001 Local Groups
• T1069.002 Domain Groups
• T1071.001 Web Protocols
• T1071.003 Mail Protocols
• T1078.003 Local Accounts
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1087.001 Local Account
• T1087.002 Domain Account
• T1090 Proxy
• T1090.001 Internal Proxy
• T1102 Web Service
• T1102.002 Bidirectional Communication
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1110 Brute Force
• T1112 Modify Registry
• T1120 Peripheral Device Discovery
• T1124 System Time Discovery
• T1134.002 Create Process with Token
• T1140 Deobfuscate/Decode Files or Information
• T1189 Drive-by Compromise
• T1201 Password Policy Discovery
• T1204.001 Malicious Link
• T1213.006 Databases
• T1518.001 Security Software Discovery
• T1546.003 Windows Management Instrumentation Event Subscription
• T1546.013 PowerShell Profile
• T1547.001 Registry Run Keys / Startup Folder
• T1547.004 Winlogon Helper DLL
• T1553.006 Code Signing Policy Modification
• T1555.004 Windows Credential Manager
• T1560.001 Archive via Utility
• T1564.012 File/Path Exclusions
• T1566.002 Spearphishing Link
• T1567.002 Exfiltration to Cloud Storage
• T1570 Lateral Tool Transfer
• T1583.006 Web Services
• T1584.003 Virtual Private Server
• T1584.004 Server
• T1584.006 Web Services
• T1587.001 Malware
• T1588.001 Malware
• T1588.002 Tool
• T1615 Group Policy Discovery
• T1685 Disable or Modify Tools

Software 30

• Mimikatz
• Uroburos
• PsExec
• Net
• Tasklist
• Reg
• Epic
• Systeminfo
• Arp
• nbtstat
• netstat
• ComRAT
• certutil
• Gazer
• Mosquito
• Kazuar
• Carbon
• Empire
• PowerStallion
• LightNeuron
• HyperStack
• Crutch
• IronNetInjector
• Penquin
• NBTscan
• TinyTurla
• KOPILUWAK
• LunarWeb
• LunarMail
• LunarLoader

Principal sources 79 reports

Ranked by how many of this actor's indicators each report brought in.

• 47securelist.com/satellite-turla-apt-command-and-control…
• 43github.com/eset/malware-ioc/tree/master/turla
• 40artemonsecurity.com/snake_whitepaper.pdf
• 38symantec.com/content/en/us/enterprise/media/security…
• 38info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.p…
• 28welivesecurity.com/en/eset-research/moon-backdoors-lunar-l…
• 28github.com/eset/malware-ioc/tree/master/turla#netw…
• 28otx.alienvault.com/pulse/57b4ad5cd19e030139028e28

Related groups 6

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• APT39 G0087
  1 shared indicator
• UNC1151
  2 reports cite both
• Star Blizzard G1033
  1 report cite both
• APT32 G0050
  shares Arp
• MirrorFace G1054
  shares nbtstat
• OilRig G0049
  shares Reg, Systeminfo

Timeline 325 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 325. Complete: G0010.json.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-06-26 5 domain, 1 urlthis year

   cloud.google.com/blog/topics/threat-intelligence/stockst…

   domain	canal1zac1a.onrender.com
   domain	driverx86-adobe.onrender.com
   domain	google-ai-labs-it.onrender.com
   domain	weatherdataai.theworkpc.com
   domain	wool-basalt-clock.glitch.me
   url	circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php

   copy batch

2. 2026-06-20 15 domain, 12 ipv4this year

   x.com/_IMalihi_/status/2068422081855836300

   domain	api.softwareupdatenews.com
   domain	cdn.datacenterate.com
   domain	datacenterate.com
   domain	dzerl.com
   domain	en.footballcharge.us
   domain	footballcharge.us
   domain	minkstore.vip
   domain	newscloud.mn
   domain	ns.minkstore.vip
   domain	onekey-host.com
   domain	softwareupdatenews.com
   domain	studiokaspersky.com
   domain	update.studiokaspersky.com
   domain	waterwinterend.com
   domain	webfurina.com
   ipv4	103.136.43.65:443
   ipv4	103.143.40.60:443
   ipv4	103.143.40.91:443
   ipv4	103.30.76.194:443
   ipv4	104.167.16.42:443
   ipv4	185.253.116.122:443
   ipv4	194.36.190.17:443
   ipv4	205.186.64.197:443
   ipv4	38.180.173.194:443
   ipv4	45.89.107.77:443
   ipv4	46.17.45.93:443
   ipv4	5.252.176.22:443

   copy batch

3. 2026-06-18 1 ipv4this year

   x.com/phatomcandle/status/2067668684664119330

   45.64.186.26:443

   copy batch

4. 2026-01-14 1 domain, 1 ipv4, 3 urlthis year

   x.com/TheEnergyStory/status/20114072370386207… · r136a1.dev/2026/01/14/command-and-evade-turlas-kaz…

   domain	esetcloud.com
   ipv4	185.126.255.132:443
   url	arianeconseil.online/wp-includes/sitemaps/html/
   url	download.originalapk.com/wp-content/plugins/loginizer/styles/
   url	portal.northernfruit.com/wp-content/plugins/file-away/core/

   copy batch

5. 2026-01-02 or earlier 3 domain, 3 urlthis year

   welivesecurity.com/en/eset-research/gamaredon-x-turla-coll… · github.com/eset/malware-ioc/tree/master/turla#gama… · virustotal.com/gui/file/3ecb09e659bcb500f9f40d022579a0…

   domain	ekrn.ydns.eu
   domain	eset.ydns.eu
   domain	lucky-king-96d6.mopig92456.workers.dev
   url	abrargeospatial.ir/wp-includes/fonts/wp-icons/index.php
   url	brannenburger-nagelfluh.de/wp-includes/style-engine/css/index.php
   url	pizzeria-mercy.de/wp-includes/images/media/bar/index.php

   copy batch

6. 2026-01-02 or earlier 3 domainthis year

   microsoft.com/en-us/security/blog/2025/07/31/frozen-i… · virustotal.com/gui/ip-address/107.189.18.66/relations · virustotal.com/gui/ip-address/45.61.149.109/relations · virustotal.com/gui/file/13fafb1ae2d5de024e68f2e2fc820b…

   excelupdates.org

   kav-certificate.net

   kav-certificates.info

   copy batch

7. 2026-01-02 or earlier 1 domain, 1 ipv4this year

   censys.com/blog/2025-state-of-the-internet-malware…

   domain	secdesk.xyz
   ipv4	154.53.42.194:8062

   copy batch

8. 2026-01-02 or earlier 1 domainthis year

   cyble.com/blog/tiny-backdoor-goes-undetected-susp… · virustotal.com/gui/file/8c97df4ca1a5995e22c2c4887bea29…

   ies.inquirer.com.ph

   copy batch

9. 2024-12-13 2 domain2 yrs ago

   microsoft.com/en-us/security/blog/2024/12/04/frequent…

   connectotels.net

   hostelhotels.net

   copy batch

10. 2024-05-17 5 domain2 yrs ago

    x.com/BushidoToken/status/1791484308693086437 · virustotal.com/gui/ip-address/185.206.180.130/relations · virustotal.com/gui/file/d2fad779289732d1edf932b62278eb…

    av.master.dns-cloud.net

    avmaster.dns-cloud.net

    in.thedarktower.av.master.dns-cloud.net

    mentionedthedarktower.av.master.dns-cloud.net

    thedarktower.av.master.dns-cloud.net

    copy batch

11. 2024-05-16 2 url2 yrs ago

    welivesecurity.com/en/eset-research/moon-backdoors-lunar-l… · github.com/eset/malware-ioc/tree/master/turla#netw…

    http://169.255.137.203

    http://217.171.86.137

    copy batch

12. 2024-03-22 6 domain2 yrs ago

    blog.talosintelligence.com/tinyturla-full-kill-chain

    buy-new-car.com

    caduff-sa.chjeepcarlease.com

    carleasingguru.com

    chjeepcarlease.com

    hanagram.jpthefinetreats.com

    jpthefinetreats.com

    copy batch

13. 2024-02-15 4 url2 yrs ago

    blog.talosintelligence.com/tinyturla-next-generation · virustotal.com/gui/file/267071df79927abd1e57f57106924d… · virustotal.com/gui/file/d6ac21a409f35a80ba9ccfe58ae1ae…

    caduff-sa.ch/wordpress/wp-includes/rss.old.php

    hanagram.jp/wp/wp-content/themes/hanagram/rss-old.php

    jeepcarlease.com/wp-includes/blocks/rss.old.php

    thefinetreats.com/wp-content/themes/twentyseventeen/rss-old.php

    copy batch

14. 2023-07-22 16 url, 3 url_path3 yrs ago

    cert.gov.ua/article/5213167 (# UAC-0024, UAC-0003)

    url	adelaida.ua/plugins/vmsearch/wp-config-plugins.php
    url	adelaida.ua/plugins/vmsearch/wp-config-themes.php
    url	adelaida.ua/plugins/vmsearch/wp-file-script.js
    url	aleimportadora.net/images/slides_logo/
    url	atomydoc.kg/src/open_center/
    url	mail.aet.in.ua/outlook/api/logoff.aspx
    url	mail.aet.in.ua/outlook/api/logon.aspx
    url	mail.arlingtonhousing.us/outlook/api/logoff.aspx
    url	mail.kzp.bg/outlook/api/logoff.aspx
    url	mail.kzp.bg/outlook/api/logon.aspx
    url	mail.lebsack.de/microsoft.exchange.mailboxreplicationservice.proxyservice/rpcwithcert/sync
    url	mail.lechateaudelatour.fr/microsoft.exchange.mailboxreplicationservice.proxyservice/rpcwithcert/sync
    url	mail.numina.md/owa/scripts/logon.aspx
    url	octoberoctopus.co.za/wp-includes/sitemaps/web/
    url	pierreagencement.fr/wp-content/languages/index.php
    url	sansaispa.com/wp-includes/images/gallery/
    url_path	/microsoft.exchange.mailboxreplicationservice.proxyservice/
    url_path	/microsoft.exchange.mailboxreplicationservice.proxyservice/rpcwithcert/
    url_path	/microsoft.exchange.mailboxreplicationservice.proxyservice/rpcwithcert/sync

    copy batch

15. 2023-04-26 1 domain, 2 url3 yrs ago

    securelist.com/tomiris-called-they-want-their-turla-ma… · otx.alienvault.com/pulse/64469f924625bdef62b1debc

    domain	mail.mfa.uz.webmails.info
    url	crane.mn/wp-content/plugins/jetpack/modules/photon-cdn/
    url	telegram.akipress.news/lsasss.rar

    copy batch

16. 2023-04-02 1 url3 yrs ago

    twitter.com/Gi7w0rm/status/1642551370287816704

    http://45.8.144.161

    copy batch

17. 2023-01-05 2 domain, 1 ipv43 yrs ago

    mandiant.com/resources/blog/turla-galaxy-opportunity · virustotal.com/gui/file/6536b6b50aa1f6899ffa90aaf4b1b6… · virustotal.com/gui/file/8d9bb878a18b2b7ef558504e78a59e…

    domain	manager.surro.am
    domain	surro.am
    ipv4	194.67.209.186:443

    copy batch

18. 2022-08-01 1 domain4 yrs ago

    twitter.com/sekoia_io/status/1554086468104196096

    cyberazov.tk

    copy batch

19. 2022-07-20 1 domain4 yrs ago

    blog.google/threat-analysis-group/continued-cyber-a…

    stopwar.pro

    copy batch

20. 2022-07-08 1 domain, 1 url_path4 yrs ago

    twitter.com/billyleonard/status/1545461166377508865 · twitter.com/billyleonard/status/1545461171456729090 · virustotal.com/gui/file/3c62b24594ec3cacc14bdca068a027… · virustotal.com/gui/file/745e8c90a8e76f81021ff491cbc275…

    domain	cyberazov.com
    url_path	/CyberAzov.apk

    copy batch

21. 2022-05-24 1 domain4 yrs ago

    blog.sekoia.io/turla-new-phishing-campaign-eastern-eur… · otx.alienvault.com/pulse/628ba3b7c4e0efc200be0582 · virustotal.com/gui/ip-address/45.153.241.162/relations · virustotal.com/gui/ip-address/79.110.52.218/relations

    baltdefcol.webredirect.org

    copy batch

22. 2022-05-04 2 domain4 yrs ago

    otx.alienvault.com/pulse/6272996039678903e0b73dd5 · blog.sekoia.io/turla-new-phishing-campaign-eastern-eur… · otx.alienvault.com/pulse/628ba3b7c4e0efc200be0582 · virustotal.com/gui/ip-address/45.153.241.162/relations · virustotal.com/gui/ip-address/79.110.52.218/relations

    jadlactnato.webredirect.org

    wkoinfo.webredirect.org

    copy batch

23. 2022-04-05 2 domain4 yrs ago

    lab52.io/blog/complete-dissection-of-an-apk-with… · thehackernews.com/2022/04/researchers-uncover-new-android… · otx.alienvault.com/pulse/624c2c7f9f25362f604a9606 · virustotal.com/gui/file/e0eacd72afe39de3b327a164f9c69a…

    d3hdbjtb1686tn.cloudfront.net

    da.anythinktech.com

    copy batch

24. 2022-04-04 1 url4 yrs ago

    lab52.io/blog/complete-dissection-of-an-apk-with… · thehackernews.com/2022/04/researchers-uncover-new-android… · otx.alienvault.com/pulse/624c2c7f9f25362f604a9606 · virustotal.com/gui/file/e0eacd72afe39de3b327a164f9c69a…

    http://82.146.35.240

    copy batch

25. 2022-02-01 1 domain4 yrs ago

    cyberark.com/resources/threat-research-blog/krypton-… · virustotal.com/gui/file/a84f1fe984e6fb04af0e029b67245f…

    f0304768.xsph.ru

    copy batch

26. 2021-04-22 1 domain5 yrs ago

    twitter.com/rnaksyrn/status/1097522490111418368 · virustotal.com/gui/file/5b4ed1dc85f5551f070693cf1faf80…

    worldnews.ath.cx

    copy batch

27. 2020-12-02 4 domain6 yrs ago

    welivesecurity.com/2020/12/02/turla-crutch-keeping-back-do… · otx.alienvault.com/pulse/5fc7b28bd5c07b0b777106b9

    ethdns.mywire.org

    highcolumn.webredirect.org

    hotspot.accesscam.org

    theguardian.webredirect.org

    copy batch

28. 2020-10-28 6 url6 yrs ago

    accenture.com/us-en/blogs/cyber-defense/turla-belugas… · otx.alienvault.com/pulse/5f99a34fe3c5a08a4093e54d

    balletmaniacs.com/wp-includes/fonts/icons/

    berlinguas.com/wp-content/languages/index.php

    bombheros.com/wp-content/languages/index.php

    mtsoft.hol.es/wp-content/gallery/

    polishpod101.com/forum/language/en/sign/

    simplifiedhomesales.com/wp-includes/images/index.php

    copy batch

29. 2020-07-14 1 domain6 yrs ago

    telsy.com/turla-venomous-bear-updates-its-arsenal… · otx.alienvault.com/pulse/5f0e0247a1f88359cebcccb2

    newshealthsport.com

    copy batch

30. 2020-05-26 27 domain6 yrs ago

    welivesecurity.com/2020/05/26/agentbtz-comratv4-ten-year-j… · us-cert.cisa.gov/ncas/analysis-reports/ar20-303a · github.com/eset/malware-ioc/tree/master/turla#turl…

    arinas.tk

    bedrost.com

    branter.tk

    bronerg.tk

    celestyna.tk

    crusider.tk

    davilta.tk

    deme.ml

    dixito.ml

    duke6.tk

    elizabi.tk

    foods.jkub.com

    hofa.tk

    hunvin.tk

    lakify.ml

    lindaztert.net

    misters.ml

    pewyth.ga

    progress.zyns.com

    sameera.gq

    sanitar.ml

    scrabble.ikwb.com

    sumefu.gq

    umefu.gq

    vefogy.cf

    vylys.com

    wekanda.tk

    copy batch

31. 2020-03-12 1 domain, 2 ipv4, 6 url6 yrs ago

    welivesecurity.com/2020/03/12/tracking-turla-new-backdoor-… · otx.alienvault.com/pulse/5e6a1997e4301d0827885c98

    domain	adgf.am
    ipv4	134.209.222.206:15363
    ipv4	85.222.235.156:8000
    url	aiisa.am/js/chatem/js_rA9bo8_O3Pnw_5wJXExNhtkUMdfBYCifTJctEJ8C_Mg.js
    url	armconsul.ru/user/themes/ayeps/dist/js/bundle.0eb0f2cb2808b4b35a94.js
    url	http://37.59.60.199
    url	mnp.nkr.am/wp-includes/js/jquery/jquery-migrate.min.js
    url	skategirlchina.com/wp-includes/data_from_db_top.php
    url	skategirlchina.com/wp-includes/ms-locale.php

    copy batch

32. 2020-02-24 21 domain6 yrs ago

    otx.alienvault.com/pulse/57b4ad5cd19e030139028e28

    archive-articles.linkpc.net

    badget.ignorelist.com

    bestfunc.slyip.net

    blackerror.ignorelist.com

    booking.strangled.net

    ceremon.2waky.com

    climbent.mooo.com

    dellservice.publicvm.com

    forumgeek.zzux.com

    kersachi.ignorelist.com

    knowledgetime.slyip.net

    newforum.chickenkiller.com

    papperbell.effers.com

    patherror.publicvm.com

    priceline.publicvm.com

    profound.zzux.com

    top100news.my-wan.de

    treesofter.mooo.com

    trytowin.ignorelist.com

    wordlisten.mooo.com

    worldlist.linkpc.net

    copy batch

33. 2019-10-07 29 domain7 yrs ago

    securelist.com/satellite-turla-apt-command-and-control…

    accessdest.strangled.net

    bookstore.strangled.net

    bug.ignorelist.com

    chinafood.chickenkiller.com

    coldriver.strangled.net

    developarea.mooo.com

    downtown.crabdance.com

    easport-news.publicvm.com

    eurovision.chickenkiller.com

    goldenroade.strangled.net

    greateplan.ocry.com

    industrywork.mooo.com

    leagueoflegends.servequake.com

    mediahistory.linkpc.net

    new-book.linkpc.net

    newgame.2waky.com

    nightstreet.toh.info

    radiobutton.mooo.com

    sealand.publicvm.com

    securesource.strangled.net

    softstream.strangled.net

    sportacademy.my03.com

    sportnewspaper.strangled.net

    supercar.ignorelist.com

    supernews.instanthq.com

    telesport.mooo.com

    track.strangled.net

    wargame.ignorelist.com

    wintersport.mrbasic.com

    copy batch

34. 2019-10-07 2 domain7 yrs ago

    securelist.com/satellite-turla-apt-command-and-control… · otx.alienvault.com/pulse/57b4ad5cd19e030139028e28

    highhills.ignorelist.com

    onlineshop.sellclassics.com

    copy batch

35. 2019-09-18 1 domain7 yrs ago

    twitter.com/daphiel/status/1174324244127322115

    dsme.info

    copy batch

36. 2019-06-20 5 domain7 yrs ago

    symantec.com/blogs/threat-intelligence/waterbug-espi…

    codewizard.ml

    dubaiexpo2020.cf

    markham-travel.com

    microsoft.updatemeltdownkb7234.com

    zebra.wikaba.com

    copy batch

37. 2019-06-20 2 domain7 yrs ago

    virustotal.com/gui/ip-address/94.249.192.182/relations

    dropbox12.com

    moscow.stransgroup.com

    copy batch

38. 2019-06-20 1 url7 yrs ago

    virustotal.com/gui/ip-address/185.141.62.32/relations

    http://185.141.62.32

    copy batch

39. 2019-05-29 19 url7 yrs ago

    github.com/eset/malware-ioc/tree/master/turla · welivesecurity.com/en/eset-research/moon-backdoors-lunar-l… · github.com/eset/malware-ioc/tree/master/turla#netw…

    ales.ball-mill.es/ckfinder/core/connector/php/php4/CommandHandler/CommandHandler.php

    aviasiya.com/murad.by/life/wp-content/plugins/wp-accounting/inc/pages/page-search.php

    baby.greenweb.co.il/wp-content/themes/san-kloud/admin.php

    chagiocaxuanson.esy.es/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/ngglegacy/admin/templates/manage_gallery/gallery_preview_page_field.old.php

    daybreakhealthcare.co.uk/wp-includes/themees.php

    dyskurs.com.ua/wp-admin/includes/map-menu.php

    giadinhvabe.net/wp-content/themes/viettemp/out/css/class.php

    hotnews.16mb.com/wp-content/themes/twentysixteen/template-parts/content-header.php

    kennynguyen.esy.es/wp-content/plugins/wp-statistics/vendor/maxmind-db/reader/tests/MaxMind/Db/test/Reader/BuildTest.php

    outletpiumini.springwaterfeatures.com/wp-includes/pomo/settings.php

    shinestars-lifestyle.com/old_shinstar/includes/old/front_footer.old.php

    simplecreative.design/wp-content/plugins/calculated-fields-form/single.php

    soligro.com/wp-includes/pomo/db.php

    sonneteck.com/wp-content/plugins/yith-woocommerce-wishlist/plugin-fw/licence/templates/panel/activation/activation.php

    tekfordummies.com/wp-content/plugins/social-auto-poster/includes/libraries/delicious/Delicious.php

    warrixmalaysia.com.my/wp-content/plugins/jetpack/modules/contact-form/grunion-table-form.php

    weandcats.com/wp-content/plugins/broken-link-checker/modules/checkers/http-module.php

    zerogov.com/wp-content/plugins.deactivate/paypal-donations/src/PaypalDonations/SimpleSubsribe.php

    zszinhyosz.pe.hu/wp-content/themes/twentyfourteen/page-templates/full-hight.php

    copy batch

40. 2019-05-29 2 url7 yrs ago

    github.com/eset/malware-ioc/blob/master/turla/READ… · github.com/eset/malware-ioc/tree/master/turla · welivesecurity.com/en/eset-research/moon-backdoors-lunar-l… · github.com/eset/malware-ioc/tree/master/turla#netw…

    lasac.eu/credit_payment/url/

    shoppingexpert.it/wp-content/gallery/

    copy batch

41. 2019-05-09 2 domain7 yrs ago

    symantec.com/blogs/threat-intelligence/waterbug-espi…

    vision2030.cf

    vision2030.tk

    copy batch

42. 2019-05-07 1 domain7 yrs ago

    twitter.com/James_inthe_box/status/1125800284272226…

    orl05511cn.temp.swtest.ru

    copy batch

43. 2019-05-03 1 domain, 1 url_path7 yrs ago

    twitter.com/James_inthe_box/status/1124278816753442…

    domain	tapok121.jhfree.net
    url_path	/connect_meta.php

    copy batch

44. 2019-05-01 1 domain7 yrs ago

    symantec.com/blogs/threat-intelligence/waterbug-espi…

    updatenodes.site

    copy batch

45. 2019-03-18 2 url7 yrs ago

    twitter.com/VK_Intel/status/1089959988116799491

    northviewcanada.com/wp-content/galler/slider/

    zycie-chotomowa.pl/wp-content/languages/index.php

    copy batch

46. 2018-09-12 3 url8 yrs ago

    github.com/eset/malware-ioc/tree/master/turla

    http://169.255.137.203/rss_0.php

    http://217.171.86.137/config.php

    http://217.171.86.137/rss_0.php

    copy batch

47. 2018-03-28 9 domain8 yrs ago

    welivesecurity.com/2018/01/09/turlas-backdoor-laced-flash-… · github.com/eset/malware-ioc/tree/master/turla

    adstore.twilightparadox.com

    agony.compress.to

    auberdine.etowns.net

    bigpen.ga

    fleetwood.tk

    gallop.mefound.com

    robot.wikaba.com

    skyrim.3d-game.com

    smallcloud.ga

    copy batch

48. 2018-03-28 5 domain8 yrs ago

    welivesecurity.com/2018/01/09/turlas-backdoor-laced-flash-… · github.com/eset/malware-ioc/tree/master/turla · otx.alienvault.com/pulse/57b4ad5cd19e030139028e28

    ebay-global.publicvm.com

    officebuild.4irc.com

    psychology-blog.ezua.com

    sendmessage.mooo.com

    tellmemore.4irc.com

    copy batch

49. 2017-04-07 5 url9 yrs ago

    github.com/eset/malware-ioc/blob/master/turla/READ… · github.com/eset/malware-ioc/tree/master/turla · welivesecurity.com/en/eset-research/moon-backdoors-lunar-l… · github.com/eset/malware-ioc/tree/master/turla#netw…

    61paris.fr/wp-includes/ms-set.php

    doctorshand.org/wp-content/about/

    jucheafrica.com/wp-includes/class-wp-edit.php

    soheylistore.ir/modules/mod_feed/feed.php

    tazohor.com/wp-includes/feed-rss-comments.php

    copy batch

50. 2016-02-23 1 domain10 yrs ago

    symantec.com/security_response/writeup.jsp?docid=201…

    news-bbc.podzone.org

    copy batch

51. 2016-02-23 1 domain10 yrs ago

    symantec.com/content/en/us/enterprise/media/security…

    scifi.pages.at

    copy batch

52. 2015-10-20 12 domain11 yrs ago

    symantec.com/content/en/us/enterprise/media/security…

    61paris.fr

    booking.etowns.org

    easports.3d-game.com

    greece-travel.servepics.com

    jucheafrica.com

    musicplanet.servemp3.com

    pokerface.servegame.com

    soheylistore.ir

    support4u.5u.com

    tazohor.com

    te4step.tripod.com

    world-weather.zapto.org

    copy batch

53. 2015-10-20 3 domain11 yrs ago

    symantec.com/security-center/writeup/2014-011316-192… · symantec.com/content/en/us/enterprise/media/security…

    nightday.comxa.com

    sanky.sportsontheweb.net

    tiger.netii.net

    copy batch

54. 2015-10-20 1 domain11 yrs ago

    symantec.com/security-center/writeup/2014-011316-192… · artemonsecurity.com/snake_whitepaper.pdf · symantec.com/content/en/us/enterprise/media/security…

    north-area.bbsindex.com

    copy batch

55. 2015-10-20 1 domain11 yrs ago

    symantec.com/content/en/us/enterprise/media/security… · securelist.com/satellite-turla-apt-command-and-control…

    hockey-news.servehttp.com

    copy batch

56. 2015-10-20 1 domain11 yrs ago

    artemonsecurity.com/snake_whitepaper.pdf · symantec.com/content/en/us/enterprise/media/security…

    winter.site11.com

    copy batch

57. 2015-03-18 14 domain11 yrs ago

    info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.p… · artemonsecurity.com/snake_whitepaper.pdf

    arctic-zone.bbsindex.com

    communityeu.xp3.biz

    euassociate.6te.net

    euland.freevar.com

    eunews-online.zapto.org

    forum.4dq.com

    forum.acmetoy.com

    freeutils.3utilities.com

    interesting-news.zapto.org

    pockerroom.servebeer.com

    scandinavia-facts.sytes.net

    sportmusic.servemp3.com

    stockholm-blog.hopto.org

    copy batch · 1 more in this batch, in the JSON

Further reading 93

• secureworks.com/research/threat-profiles/iron-hunter
• attack.mitre.org/groups/G0010
• blog.talosintelligence.com/2021/09/tinyturla.html
• learn.microsoft.com/en-us/microsoft-365/security/intelligen…
• securelist.com/introducing-whitebear/81638
• securelist.com/the-epic-turla-operation/65545
• web.archive.org/web/20201101015247/https://www.accentur…
• cisa.gov/sites/default/files/2023-05/aa23-129a_s…
• crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the…
• leonardo.com/documents/20142/10868623/Malware+Techni…
• threatminer.org/report.php?q=waterbug-attack-group.pdf&…
• welivesecurity.com/2019/05/29/turla-powershell-usage
• welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.p…
• welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_M…
• welivesecurity.com/2018/01/09/turlas-backdoor-laced-flash-…
• virustotal.com/gui/file/5b4ed1dc85f5551f070693cf1faf80…
• virustotal.com/gui/file/8c97df4ca1a5995e22c2c4887bea29…
• telsy.com/turla-venomous-bear-updates-its-arsenal…
• twitter.com/billyleonard/status/1545461166377508865
• welivesecurity.com/en/eset-research/gamaredon-x-turla-coll…
• accenture.com/us-en/blogs/cyber-defense/turla-belugas…
• x.com/TheEnergyStory/status/20114072370386207…
• virustotal.com/gui/file/3ecb09e659bcb500f9f40d022579a0…
• virustotal.com/gui/file/a84f1fe984e6fb04af0e029b67245f…
• virustotal.com/gui/file/13fafb1ae2d5de024e68f2e2fc820b…
• cloud.google.com/blog/topics/threat-intelligence/stockst…
• thehackernews.com/2022/04/researchers-uncover-new-android…
• virustotal.com/gui/file/6536b6b50aa1f6899ffa90aaf4b1b6…
• blog.talosintelligence.com/tinyturla-full-kill-chain
• welivesecurity.com/en/eset-research/moon-backdoors-lunar-l…
• symantec.com/security_response/writeup.jsp?docid=201…
• otx.alienvault.com/pulse/64469f924625bdef62b1debc
• securelist.com/satellite-turla-apt-command-and-control…
• artemonsecurity.com/snake_whitepaper.pdf
• twitter.com/James_inthe_box/status/1124278816753442…
• us-cert.cisa.gov/ncas/analysis-reports/ar20-303a
• virustotal.com/gui/file/d2fad779289732d1edf932b62278eb…
• cyble.com/blog/tiny-backdoor-goes-undetected-susp…
• virustotal.com/gui/ip-address/107.189.18.66/relations
• twitter.com/daphiel/status/1174324244127322115

53 more, and the report behind every indicator, in G0010.json.