Turla (malware)
 | This article may lack focus or be about more than one topic. (June 2017) |
 | You can help expand this article with text translated from the corresponding article in Ukrainian. (June 2017) Click [show] for important translation instructions.
|
Turla or Uroboros (Russian: Турла) is a trojan package that is suspected by computer security researchers and Western intelligence officers to be the product of a Russian government agency of the same name.
High infection rates of the virus were observed in Russia, Kazakhstan and Vietnam, followed by US and China, and low infection rates in Europe, South America and Asia (including India).
Malware
Turla has been targeting governments and militaries since at least 2008.
In December 2014 there was evidence of it targeting operating systems running Linux.
Group
The advanced persistent threat hacking group has also been named Turla. The group has probably been operating since the late 1990s, according to professor Thomas Rid of Johns Hopkins University. Dan Goodin in Ars Technica described Turla as "Russian spies". Turla has since been given other names such as Snake, Krypton, and Venomous Bear.
In December 2024 researchers from Microsoft and Black Lotus Labs, the threat intelligence unit of Lumen Technologies, reported that Turla, also known as Secret Blizzard, had gained access to infrastructure operated by Storm-0156, a Pakistan-based espionage group. Beginning in 2022 Turla used this access to spy on targets in Afghanistan and India. In Afghanistan these included government and intelligence agencies; in India they included military and defense-related institutions.
US actions against group
In May 2023 the United States Department of Justice announced that the United States had managed to infiltrate machines that were infected by the malware and issue a command ordering the malware to delete itself. In the operation, codenamed Medusa, the FBI used Perseus, a tool it had built to decrypt Snake communications, to send commands that made the malware overwrite its own vital components without harming the host computer. Affidavits from the FBI and DOJ revealed that the group was part of the Russian Federal Security Service Center 16 group in Ryazan. A joint advisory published in May 2023 by the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation and partner agencies in other countries attributed Snake to a unit within FSB Center 16. It said daily operations using Snake had been run from an FSB facility in Ryazan.
Possible GoldenJackal connection
ESET noted that the command and control protocol used by GoldenJackal malware is typically used by Turla, suggesting the groups may be connected.
See also
References
- 1 2 "The Russian Britney Spears Instagram hackers also used satellites to hide their tracks". Boing Boing. 8 June 2017.
- 1 2 "Suspected Russian spyware Turla targets Europe, United States". Reuters. 2014-03-13.
- ↑ "Archived copy" (PDF). Archived from the original (PDF) on 2020-10-26. Retrieved 2018-03-01.
{{cite web}}: CS1 maint: archived copy as title (link) - ↑ "Turla Hiding in the Sky: Russian Speaking Cyberespionage Group Exploits Satellites to Reach the Ultimate Level of Anonymity". kaspersky.com. 26 May 2021.
- ↑ Brewster, Tom (7 August 2014). "Sophisticated 'Turla' hackers spying on European governments, say researchers". The Guardian.
- ↑ "Turla: Spying tool targets governments and diplomats".
- ↑ Baumgartner, Kurt (8 December 2014). "The 'Penquin' Turla". securelist.com.
- 1 2 3 Greenberg, Andy (2023-05-20). "The Underground History of Russia's Most Ingenious Hacker Group". Wired. Retrieved 2023-08-20.
- ↑ "You'll never guess where Russian spies are hiding their control servers". Ars Technica. 6 June 2017.
- ↑ Antoniuk, Daryna (2024-12-05). "Russian state hackers hijacked rival servers to spy on targets in India, Afghanistan". The Record by Recorded Future News. Retrieved 2026-10-31.
- ↑ "FBI disrupts sophisticated Russian cyberespionage operation". CyberScoop. 2023-05-09. Retrieved 2026-10-31.
- ↑ Hunting Russian Intelligence "Snake" Malware (Report). Cybersecurity and Infrastructure Security Agency. 2023-05-09. AA23-129A. Retrieved 2026-10-31.
- ↑ Lyons, Jessica (2024-10-09). "Moscow-adjacent GoldenJackal gang strikes air-gapped systems with custom malware". The Register. Retrieved 2024-10-16.
 | This malware-related article is a stub. You can help Wikipedia by adding missing information. |