[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DEXVRXSSKMYECEFCKMS5Z2":3,"skill-same:01M7DEXVRXSSKMYECEFCKMS5Z2":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DEXVRXSSKMYECEFCKMS5Z2","turla-venomous-bear",null,"Adversary-emulation profile for Turla (G0010 \u002F Venomous Bear \u002F Secret Blizzard \u002F Waterbug \u002F KRYPTON \u002F Snake), Russia's FSB Center 16 cyber-espionage actor.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fadversary-emulation\u002Fturla\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: turla-venomous-bear\ndescription: \"Adversary-emulation profile for Turla (G0010 \u002F Venomous Bear \u002F Secret Blizzard \u002F Waterbug \u002F KRYPTON \u002F Snake), Russia's FSB Center 16 cyber-espionage actor.\"\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: adversary-emulation\n  when_to_use: \"Turla, Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake, IRON HUNTER, BELUGASTURGEON, WhiteBear, FSB Center 16, G0010, Russian FSB espionage emulation, Snake rootkit, Uroburos, ComRAT, Carbon framework, Kazuar backdoor, LightNeuron Exchange, Penquin Linux, TinyTurla, satellite C2, watering hole attacks, hijacking other APT infrastructure, DNS-over-HTTPS C2, Gmail C2\"\n  tags: turla, venomous-bear, secret-blizzard, waterbug, krypton, snake, fsb, russia, espionage, nation-state, g0010, adversary-emulation, mitre-attack\n  mitre_attack: T1583.006, T1584.003, T1584.004, T1584.006, T1587.001, T1588.001, T1588.002, T1189, T1566.001, T1566.002, T1204.001, T1204.002, T1078.003, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1047, T1106, T1569.002, T1547.001, T1547.004, T1546.003, T1546.013, T1546.015, T1543.003, T1505.002, T1053.003, T1053.005, T1137.006, T1574.001, T1068, T1055, T1055.001, T1134.002, T1553.006, T1014, T1027, T1027.002, T1027.005, T1027.009, T1027.010, T1027.011, T1027.013, T1036.004, T1036.005, T1140, T1112, T1070.004, T1070.006, T1070.008, T1564.004, T1564.005, T1564.012, T1218.011, T1685, T1620, T1497.003, T1001.001, T1001.002, T1001.003, T1110, T1555.004, T1003.001, T1003.002, T1003.004, T1003.006, T1056.001, T1558.001, T1558.002, T1550.002, T1087.001, T1087.002, T1083, T1615, T1120, T1069.001, T1069.002, T1057, T1012, T1018, T1518.001, T1082, T1016, T1016.001, T1049, T1007, T1124, T1201, T1135, T1033, T1010, T1046, T1680, T1021.002, T1570, T1005, T1025, T1213.006, T1560.001, T1119, T1074.001, T1113, T1125, T1114.001, T1114.002, T1071.001, T1071.002, T1071.003, T1071.004, T1102, T1102.002, T1573.001, T1573.002, T1090, T1090.001, T1090.003, T1095, T1572, T1008, T1104, T1105, T1132.001, T1132.002, T1029, T1030, T1205, T1205.002, T1041, T1567.002, T1048.003, T1020, T1485\n---\n\n# Turla (Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake) — Adversary Emulation Profile\n\nTurla (MITRE ATT&CK **G0010**) is one of the most sophisticated and long-running cyber-espionage groups in existence, attributed to Russia's Federal Security Service (FSB) **Center 16**, operating since at least 2004. Turla has compromised victims in over 50 countries across government, diplomatic, military, defense, education, research, and pharmaceutical sectors. The group is characterized by extraordinary technical depth — from the Snake\u002FUroburos kernel rootkit and satellite-based C2 hijacking to steganographic email backdoors and the audacious practice of hijacking other nation-state APTs' infrastructure. Turla's tooling spans Windows, Linux, and macOS, with a malware ecosystem (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, TinyTurla, Lunar toolset) unmatched in breadth and longevity. The 2023 FBI Operation MEDUSA takedown of the Snake peer-to-peer network — spanning 50+ countries over nearly 20 years — underscored the global scale of Turla's operations.\n\n## Attribution & motivation\n\n- **Sponsor \u002F nation:** Russian Federation — Federal Security Service (FSB), **Center 16**. CISA has formally attributed Turla \u002F Secret Blizzard to FSB Center 16. The 2023 joint FBI\u002FCISA\u002FNSA advisory (AA23-129A) detailed the Snake malware infrastructure and attributed it to FSB officers. The NSA\u002FNCSC 2019 joint advisory documented Turla's hijacking of Iranian APT infrastructure and attributed it to the same FSB unit.\n- **Motivation:** Primarily **strategic intelligence collection (espionage)** — diplomatic, military, political, and scientific intelligence aligned with Russian state interests. Turla is a pure espionage actor with no documented financially motivated or destructive campaigns; its sole objective is persistent, covert access to high-value targets for long-term intelligence gathering.\n- **Attribution confidence:** **High.** Backed by U.S. DOJ court filings (Operation MEDUSA), joint CISA\u002FNSA\u002FFBI advisories, NSA\u002FNCSC joint attributions, and consistent named vendor reporting (ESET, Kaspersky, Microsoft, Symantec\u002FBroadcom, Palo Alto Unit 42, Mandiant, Cisco Talos, Accenture).\n\n## Targeting\n\n- **Sectors:** Government and diplomatic bodies (especially ministries of foreign affairs, embassies); military and defense; education and research institutions; pharmaceutical companies; think tanks and NGOs; media.\n- **Regions:** Primary focus on **Europe** (Eastern and Western — Germany, France, the Baltics, Balkans, Caucasus, Ukraine) and **Central Asia**. Significant targeting of **Middle East, South Asia** (via hijacked APT infrastructure), and **NATO member states** broadly. Operations documented in 50+ countries worldwide.\n- **Victim profile:** Entities whose networks yield diplomatic, military, and political intelligence — embassies, foreign ministries, parliaments, defense agencies, and academic research institutions. Turla favors long-dwell-time persistence in high-value networks over smash-and-grab operations.\n\n## Notable campaigns\n\n- **2008 — Agent.BTZ \u002F Operation Buckshot Yankee.** USB worm (Agent.BTZ) spread via infected flash drive at a U.S. Central Command base in the Middle East, infecting approximately 300,000 DoD computers across classified and unclassified networks. Described as the \"worst breach of U.S. military computers in history,\" it led to a 14-month cleanup and the creation of U.S. Cyber Command. Kaspersky Lab later documented shared XOR keys between Agent.BTZ and Turla malware. (wikipedia.org \u002F securelist.com)\n- **2014-08 — Epic Turla (Snake\u002FUroburos discovery).** Kaspersky's Global Research team publicly detailed the Epic Turla operation, revealing the Snake\u002FUroburos rootkit framework and documenting compromises across 45+ countries targeting government and diplomatic entities. The research established Turla as one of the most advanced persistent threats operating at the time. (securelist.com)\n- **2015-09 — Satellite Turla (DVB-S C2 hijacking).** Kaspersky revealed that Turla had been hijacking unencrypted DVB-S satellite internet downlinks — primarily from Middle Eastern and African ISPs — to mask C2 server locations. Evidence suggested the technique had been in use since approximately 2007. The method provided exceptional anonymity by abusing legitimate satellite subscribers' IP addresses as C2 endpoints. (securelist.com \u002F securityweek.com)\n- **2019-05 — LightNeuron Exchange backdoor.** ESET documented LightNeuron, a backdoor deployed as a Microsoft Exchange Transport Agent, enabling Turla to intercept, modify, and exfiltrate email traffic in real time. The implant used steganography to embed C2 commands within PDF and JPEG email attachments. Deployed against ministries of foreign affairs in Eastern Europe and a Central Asian diplomatic entity. (welivesecurity.com \u002F ESET)\n- **2019-10 — Hijacking Iranian APT (OilRig) infrastructure.** Joint NSA\u002FNCSC advisory revealed that Turla had compromised the C2 infrastructure of the Iranian APT group OilRig (APT34), using their VPS servers and even deploying their own implants through OilRig's existing access to victims. This marked the first publicly documented case of one nation-state APT parasitizing another's operations. (media.defense.gov \u002F NSA-NCSC advisory)\n- **2020-05 — ComRAT v4 with Gmail C2.** ESET documented ComRAT v4, the latest evolution of the decade-old ComRAT\u002FAgent.BTZ lineage, now using the Gmail web interface as a C2 channel. The backdoor received commands and exfiltrated data via email attachments, bypassing network security controls. Targets included foreign ministries in Eastern Europe and a Caucasus parliament. (welivesecurity.com \u002F ESET)\n- **2021-09 — TinyTurla.** Cisco Talos disclosed TinyTurla, a minimal backdoor installed as a Windows service disguised as a legitimate system component. Designed as a fallback access mechanism that persists even when primary implants are detected and removed. Deployed against targets in the U.S., Germany, and Afghanistan. (blog.talosintelligence.com)\n- **2023-05 — Operation MEDUSA (Snake infrastructure takedown).** FBI-led Operation MEDUSA disabled Turla's Snake malware peer-to-peer network using the custom-built PERSEUS tool, which issued self-destruct commands mimicking Snake's own session authentication protocol. The operation, authorized by a federal search warrant, disrupted Snake infrastructure across 50+ countries that had been operational for nearly 20 years. (justice.gov \u002F CISA AA23-129A)\n- **2024-12 — Hijacking Pakistani APT (Storm-0156) infrastructure.** Microsoft and Lumen Black Lotus Labs revealed that Turla (Secret Blizzard) had compromised 33 C2 servers belonging to Pakistani APT Storm-0156 since late 2022. Turla commandeered Storm-0156's CrimsonRAT backdoors to deploy its own TwoDash and Statuezy implants within Afghan government networks (Ministry of Foreign Affairs, intelligence directorate) and accessed CrimsonRAT infections on targets in India. This marked the fourth documented instance of Turla parasitizing another threat actor's infrastructure. (microsoft.com \u002F cyberscoop.com)\n\n## TTPs by ATT&CK tactic\n\n### Resource Development\n- **T1583.006** — Acquire infrastructure (web services): created accounts on Dropbox, GitHub, Pastebin, and Google (Gmail) for C2 communications and data exfiltration.\n- **T1584.003** — Compromise infrastructure (VPS): hijacked the VPS infrastructure of compromised Iranian APT OilRig\u002FAPT34 for Turla's own operations.\n- **T1584.004** — Compromise infrastructure (server): extensively used compromised servers — particularly WordPress sites — as C2 relay nodes.\n- **T1584.006** — Compromise infrastructure (web services): co-opted compromised WordPress sites for C2 hosting.\n- **T1587.001** — Develop capabilities (malware): developed an extensive custom malware ecosystem spanning two decades (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, Gazer, Mosquito, TinyTurla, Lunar toolset, Epic, HyperStack, Crutch, KOPILUWAK).\n- **T1588.001** — Obtain capabilities (malware): obtained and reused malware from compromised threat actors, notably commandeering OilRig tools and Storm-0156's CrimsonRAT.\n- **T1588.002** — Obtain capabilities (tool): obtained and customized publicly available tools including Mimikatz, Metasploit\u002FMeterpreter, PowerShell Empire, PowerSploit, PsExec, and NBTscan.\n\n### Initial Access\n- **T1189** — Drive-by compromise: signature Turla technique; conducted watering hole attacks on government and embassy websites to deliver exploits and backdoors (Epic Turla campaign, ComRAT delivery).\n- **T1566.001** — Spearphishing attachment: delivered weaponized documents and archives (KOPILUWAK JavaScript dropper via spearphishing attachments).\n- **T1566.002** — Spearphishing link: sent phishing emails with links to seemingly legitimate domains (e.g., fake Adobe download pages) to trick targets into downloading Mosquito installer malware.\n- **T1204.001 \u002F T1204.002** — User execution (malicious link \u002F malicious file): relied on user execution of phishing links and weaponized document files to establish initial footholds.\n- **T1078.003** — Valid accounts (local): abused local accounts with reused passwords across victim networks for initial and sustained access.\n\n### Execution\n- **T1059.001** — PowerShell: extensively used PowerShell for post-compromise operations, including Empire PSInject for reflective payload injection, PowerSploit's `Out-EncryptedScript.ps1` for encrypted payloads, and custom PowerShell backdoors with RPC-based C2. ESET documented Turla's comprehensive PowerShell-based toolchain in 2019.\n- **T1059.003** — Windows Command Shell: RPC backdoors and multiple malware families (ComRAT, Uroburos, TinyTurla, LunarWeb, LightNeuron, Kazuar) used `cmd.exe` for command execution.\n- **T1059.004** — Unix shell: Kazuar (multiplatform) and Penquin (Linux backdoor) executed commands via Unix shell on Linux targets.\n- **T1059.005** — Visual Basic: used VBS scripts in operations (Waterbug\u002FSymantec reporting) and LunarMail Outlook add-in backdoor used VBA.\n- **T1059.006** — Python: IronNetInjector toolchain used IronPython scripts to drop and execute payloads.\n- **T1059.007** — JavaScript: deployed various JavaScript-based backdoors (Mosquito installer, KOPILUWAK JavaScript reconnaissance tool).\n- **T1047** — Windows Management Instrumentation: used WMI via LunarWeb, Kazuar, Mosquito, and Empire for execution and reconnaissance.\n- **T1106** — Native API: RPC backdoors and multiple implants (Uroburos, Mosquito, TinyTurla, HyperStack) made direct Windows API calls for execution, AMSI bypasses, and IPC.\n- **T1569.002** — Service execution: TinyTurla and Net utility used for executing payloads via Windows services.\n\n### Persistence\n- **T1547.001** — Registry Run keys \u002F Startup folder: JavaScript backdoors set `HKLM\\...\\Run` keys; Metasploit shellcode executables saved to Startup folder; Gazer, Kazuar, and Mosquito used Run key persistence.\n- **T1547.004** — Winlogon Helper DLL: established persistence via `HKCU\\...\\Winlogon` Shell value modifications (Mosquito installer, Gazer).\n- **T1546.003** — WMI Event Subscription: PowerShell toolchain used WMI event filters and consumers for persistent backdoor activation.\n- **T1546.013** — PowerShell Profile: modified PowerShell profiles to execute malicious payloads on interpreter startup, providing persistence through legitimate PowerShell usage.\n- **T1546.015** — COM hijacking: ComRAT and Mosquito hijacked COM objects for persistence and execution.\n- **T1543.003** — Windows service: Carbon, Kazuar, Uroburos\u002FSnake, and TinyTurla installed as Windows services for persistent execution; TinyTurla masqueraded as a legitimate Windows Time service component.\n- **T1505.002** — Transport Agent: LightNeuron installed as a Microsoft Exchange Transport Agent, intercepting all email traffic through the server — one of the most novel persistence mechanisms documented.\n- **T1053.005** — Scheduled task: Carbon, ComRAT, Crutch, Gazer, and IronNetInjector used Windows scheduled tasks for periodic execution.\n- **T1053.003** — Cron: Penquin Linux backdoor used cron jobs for persistence on Linux targets.\n- **T1137.006** — Office add-ins: LunarLoader and LunarMail persisted as Outlook add-ins, executing whenever the Outlook application launched.\n- **T1574.001** — DLL hijacking: Crutch backdoor abused DLL search-order hijacking for persistence and execution.\n\n### Privilege Escalation\n- **T1068** — Exploitation for privilege escalation: exploited VBoxDrv.sys driver vulnerabilities to achieve kernel-mode execution (AcidBox reporting by Unit 42).\n- **T1055 \u002F T1055.001** — Process injection \u002F DLL injection: used PowerSploit's `Invoke-ReflectivePEInjection.ps1` for reflective PE injection; Metasploit reflective DLL injection for privilege escalation; IronNetInjector, Kazuar, Uroburos, Carbon, and Gazer used DLL injection.\n- **T1134.002** — Access token manipulation (Create Process with Token): RPC backdoors impersonated or stole process tokens before executing commands.\n- **T1553.006** — Code Signing Policy Modification: modified kernel memory variables to disable Driver Signature Enforcement after achieving kernel-mode privileges, enabling unsigned driver loading (Turla Driver Loader).\n\n### Defense Evasion\n- **T1014** — Rootkit: Uroburos\u002FSnake operated as a kernel-mode rootkit with hidden filesystems, custom encrypted peer-to-peer networking, and covert protocol impersonation — active for nearly 20 years before the FBI disrupted it.\n- **T1027 \u002F T1027.002 \u002F T1027.005** — Obfuscation \u002F software packing \u002F indicator removal from tools: Uroburos used software packing; Gazer versions had IoC strings (mutex names, named pipes) deliberately obfuscated between variants; Penquin removed identifiable strings.\n- **T1027.009** — Embedded payloads: ComRAT and Uroburos embedded secondary payloads within their binaries.\n- **T1027.010** — Command obfuscation: used salted 3DES encryption (via PowerSploit), random variable names, and base64 encoding to obfuscate PowerShell commands.\n- **T1027.011** — Fileless storage: stored encrypted payloads in Windows Registry values (PowerShell backdoors, Mosquito, TinyTurla, Uroburos, ComRAT).\n- **T1027.013** — Encrypted\u002Fencoded file: multiple families (Gazer, Mosquito, Penquin, LightNeuron, LunarWeb, LunarMail, IronNetInjector) used encrypted files for payload storage and transport.\n- **T1036.004 \u002F T1036.005** — Masquerading: TinyTurla masqueraded as a Windows Time service DLL (`w32time.dll`); LunarWeb components mimicked Zabbix agent logs; LightNeuron and Penquin matched legitimate resource names and locations.\n- **T1140** — Deobfuscate\u002FDecode: custom decryption routines pulled keys and salts from WMI filters or PowerShell profiles to decode encrypted payloads at runtime.\n- **T1112** — Modify Registry: stored payloads, configuration data, and C2 parameters in Registry values across multiple malware families.\n- **T1070.004 \u002F T1070.006 \u002F T1070.008** — Indicator removal: file deletion (multiple families); timestomping (Gazer, PowerStallion); clearing mailbox data (LunarMail removed evidence of C2 emails).\n- **T1564.004** — NTFS file attributes: Gazer hid data in alternate NTFS data streams.\n- **T1564.005** — Hidden file system: ComRAT and Uroburos\u002FSnake maintained hidden virtual file systems for covert data storage.\n- **T1564.012** — File\u002FPath exclusions: LunarWeb installed files into directories excluded from antivirus scanning.\n- **T1218.011** — Rundll32: Mosquito used Rundll32 for proxy execution of malicious DLLs.\n- **T1685** — Disable or Modify Tools: PowerShell scripts patched the in-memory `amsi.dll` to bypass Windows AMSI (Antimalware Scan Interface).\n- **T1620** — Reflective code loading: LunarLoader and Uroburos used reflective loading to execute payloads directly in memory.\n- **T1497.003** — Virtualization\u002FSandbox evasion (time-based): LunarWeb used time-based checks to detect analysis environments.\n- **T1001.001 \u002F T1001.002 \u002F T1001.003** — Data obfuscation: Uroburos injected junk data and used protocol impersonation (HTTP to masquerade raw TCP); LightNeuron, LunarWeb, and LunarMail used **steganography** to embed C2 commands in PDF and JPEG email attachments.\n\n### Credential Access\n- **T1110** — Brute force: attempted network authentication with predefined password lists using `net use` commands.\n- **T1555.004** — Windows Credential Manager: gathered stored credentials from Windows Credential Manager.\n- **T1003.001 \u002F T1003.002 \u002F T1003.004 \u002F T1003.006** — OS credential dumping: used Mimikatz for LSASS memory dumping, SAM database extraction, LSA secrets access, and **DCSync** replication attacks to obtain domain credentials.\n- **T1056.001** — Keylogging: Snake\u002FUroburos and Empire deployed keyloggers alongside primary implants to capture authentication credentials.\n- **T1558.001 \u002F T1558.002** — Kerberos ticket forging: used Mimikatz to generate **golden tickets** (domain-wide persistence) and **silver tickets** (service-specific access) via Empire\u002FMimikatz integration.\n- **T1550.002** — Pass the hash: used Mimikatz for pass-the-hash lateral movement within compromised domains.\n\n### Discovery\n- **T1087.001 \u002F T1087.002** — Account discovery (local\u002Fdomain): enumerated accounts with `net user`, `net user \u002Fdomain`; HyperStack, Epic, and Kazuar performed local account enumeration.\n- **T1083** — File and directory discovery: surveyed `%TEMP%`, desktop, Program Files, and Recent directories; RPC backdoors searched for `lPH*.dll` pattern; multiple malware families perform targeted file discovery.\n- **T1615** — Group Policy discovery: used `gpresult` to enumerate Group Policy configuration.\n- **T1120** — Peripheral device discovery: used `fsutil fsinfo drives` to list connected drives.\n- **T1069.001 \u002F T1069.002** — Permission groups discovery: `net localgroup Administrators`, `net group \"Domain Admins\" \u002Fdomain` for privilege mapping.\n- **T1057** — Process discovery: `tasklist \u002Fv` and RPC backdoor enumeration of processes by open ports\u002Fnamed pipes; used across Carbon, Epic, Kazuar, Mosquito, LunarWeb, KOPILUWAK, PowerStallion, IronNetInjector.\n- **T1012** — Query Registry: `reg query` for system enumeration; retrieved stored PowerShell payloads from Registry; checked null-session named pipe configurations.\n- **T1018** — Remote system discovery: `net view`, `net view \u002FDOMAIN`, `net group \"Domain Computers\" \u002Fdomain`, `net group \"Domain Controllers\" \u002Fdomain`, `net group \"Exchange Servers\" \u002Fdomain` for network mapping.\n- **T1518.001** — Security software discovery: enumerated security products and logging configurations to assess detection risk.\n- **T1082** — System information discovery: `systeminfo`, `set` commands; used across Epic, Gazer, Kazuar, LightNeuron, LunarWeb, Penquin, Uroburos.\n- **T1016 \u002F T1016.001** — Network configuration \u002F internet connection discovery: `arp -a`, `nbtstat -n`, `net config`, `ipconfig \u002Fall`, `route`, NBTscan, and `tracert` for network reconnaissance.\n- **T1049** — System network connections discovery: `netstat -an`, `net use`, `net file`, `net session`; RPC backdoors enumerated TCP connections via `GetTcpTable2` API.\n- **T1007** — System service discovery: `tasklist \u002Fsvc` for service-to-process mapping.\n- **T1124** — System time discovery: `net time` command.\n- **T1201** — Password policy discovery: `net accounts`, `net accounts \u002Fdomain`.\n- **T1135** — Network share discovery: via KOPILUWAK, LunarWeb, Net utility, and Empire.\n- **T1033** — System owner\u002Fuser discovery: multiple families (Epic, Gazer, Kazuar, KOPILUWAK, LunarWeb, Mosquito, NBTscan) identified logged-in users and system owners.\n- **T1010** — Application window discovery: Kazuar enumerated open application windows.\n- **T1046** — Network service discovery: NBTscan for NetBIOS and network service enumeration.\n- **T1680** — Local storage discovery: Epic, Kazuar, KOPILUWAK, and Penquin performed local storage device enumeration.\n\n### Lateral Movement\n- **T1021.002** — SMB\u002FWindows Admin Shares: used `net use` for lateral connections and PsExec for remote service execution across internal networks.\n- **T1570** — Lateral tool transfer: RPC backdoors transferred files between victim machines on the local network; PsExec used for lateral tool deployment.\n- **T1550.002** — Pass the hash: Mimikatz-based pass-the-hash for domain-wide lateral movement.\n\n### Collection\n- **T1005** — Data from local system: RPC backdoors, Kazuar, KOPILUWAK, LightNeuron, TinyTurla, and Uroburos uploaded files from victim machines.\n- **T1025** — Data from removable media: RPC backdoors and Crutch collected files from USB thumb drives; Uroburos targeted removable media.\n- **T1213.006** — Data from information repositories (databases): used a custom .NET tool to collect documents from an organization's internal central database.\n- **T1560.001** — Archive via utility: encrypted stolen USB drive files into RAR archives; LunarWeb used compression utilities for data archival.\n- **T1119** — Automated collection: Crutch and LightNeuron performed automated file collection from local and removable storage.\n- **T1074.001** — Local data staging: Carbon, KOPILUWAK, LightNeuron, Kazuar, Crutch, and LunarMail staged collected data locally before exfiltration.\n- **T1113** — Screen capture: Kazuar and LunarMail captured screenshots for intelligence collection.\n- **T1125** — Video capture: Kazuar included webcam video capture capability.\n- **T1114.001 \u002F T1114.002** — Email collection (local\u002Fremote): LunarMail collected local Outlook emails; LightNeuron intercepted and collected email traffic in transit through Exchange Transport Agent access.\n- **T1056.001** — Keylogging: Snake and Empire keyloggers captured typed credentials and communications.\n\n### Command & Control\n- **T1071.001** — Web protocols (HTTP\u002FHTTPS): primary C2 channel for most malware families (Carbon, ComRAT, Epic, Gazer, Kazuar, KOPILUWAK, LunarWeb, Mosquito, TinyTurla, Uroburos).\n- **T1071.002** — File transfer protocols: Kazuar used FTP for C2 communications.\n- **T1071.003** — Mail protocols: **signature Turla technique** — ComRAT v4 used the Gmail web interface for C2; LightNeuron and LunarMail used email (SMTP\u002FIMAP) as C2 channels; Uroburos supported mail-protocol-based C2; CrowdStrike documented multiple backdoors communicating via email attachments.\n- **T1071.004** — DNS: Uroburos\u002FSnake included DNS-based C2 capabilities.\n- **T1102 \u002F T1102.002** — Web service \u002F bidirectional communication: used Pastebin, Dropbox, GitHub, Google Apps Script, and OneDrive for C2 and data exfiltration; JavaScript backdoors used Google Apps Script as a full C2 server.\n- **T1573.001 \u002F T1573.002** — Encrypted channel (symmetric\u002Fasymmetric): Carbon, Gazer, LunarWeb, Uroburos used asymmetric (RSA) key exchange; Epic, Mosquito, Carbon used symmetric encryption (AES, 3DES, custom XOR-based schemes); Snake\u002FUroburos implemented custom encrypted P2P protocols.\n- **T1090 \u002F T1090.001 \u002F T1090.003** — Proxy \u002F internal proxy \u002F multi-hop proxy: RPC backdoors included local UPnP proxies; TinyTurla and Kazuar compromised internal systems as proxy relays; Uroburos\u002FSnake used **multi-hop P2P proxy chains** across compromised nodes in 50+ countries.\n- **T1095** — Non-application layer protocol: Uroburos, Penquin, LunarMail, and Carbon used raw TCP\u002Fcustom protocols for C2 communications.\n- **T1572** — Protocol tunneling: Uroburos and LunarWeb tunneled C2 traffic through legitimate protocols.\n- **T1008** — Fallback channels: Uroburos, Kazuar, TinyTurla, and Crutch implemented multiple fallback C2 channels for resilience.\n- **T1104** — Multi-stage channels: Uroburos and LunarWeb used multi-stage C2 architecture with initial check-in servers routing to operational C2.\n- **T1105** — Ingress tool transfer: Meterpreter shellcode download, tool deployment across all major families.\n- **T1132.001 \u002F T1132.002** — Data encoding (standard\u002Fnon-standard): Kazuar and LunarWeb used base64 standard encoding; Uroburos used custom non-standard encoding for C2 data.\n- **T1029** — Scheduled transfer: ComRAT, Crutch, Kazuar, LightNeuron, and TinyTurla scheduled data exfiltration at fixed intervals.\n- **T1030** — Data transfer size limits: LunarWeb split exfiltration data into size-limited chunks.\n- **T1205 \u002F T1205.002** — Traffic signaling \u002F socket filters: Penquin and Uroburos used **passive network implants** that listened for magic-packet triggers rather than actively beaconing — Penquin used BPF socket filters to detect activation packets, making the backdoor virtually invisible to network monitoring.\n\n### Exfiltration\n- **T1041** — Exfiltration over C2 channel: primary exfil method for KOPILUWAK, LightNeuron, LunarMail, Penquin, TinyTurla, and Crutch.\n- **T1567.002** — Exfiltration to cloud storage: Crutch used WebDAV to upload to cloud drives; ComRAT exfiltrated to OneDrive and 4shared; Turla operations leveraged Dropbox and GitHub for data staging.\n- **T1048.003** — Exfiltration over unencrypted non-C2 protocol: Carbon exfiltrated data over alternate HTTP channels distinct from the primary C2.\n- **T1020** — Automated exfiltration: Crutch and LightNeuron automated the exfiltration of collected files without operator interaction.\n\n### Impact\n- **T1485** — Data destruction: Kazuar includes a self-destruct capability that can wipe collected data and the malware itself to cover tracks.\n\n## Signature tooling & malware\n\n| Name | ATT&CK ID | Type | Public\u002FCustom |\n|---|---|---|---|\n| Uroburos \u002F Snake | S0022 | **Kernel rootkit** + P2P C2 network (20-year lifespan) | Custom |\n| Carbon | S0335 | Second-stage modular framework | Custom |\n| ComRAT (Agent.BTZ lineage) | S0126 | Backdoor with Gmail web-UI C2 | Custom |\n| Kazuar | S0265 | Multiplatform espionage backdoor (Windows\u002FLinux) | Custom |\n| LightNeuron | S0395 | Exchange Transport Agent backdoor (steganographic C2) | Custom |\n| Penquin | S0587 | Linux backdoor (passive, BPF-based activation) | Custom |\n| Gazer (WhiteBear) | S0168 | Second-stage Windows backdoor | Custom |\n| Mosquito | S0256 | Windows installer\u002Fbackdoor | Custom |\n| Epic | S0091 | First-stage Windows implant (watering hole delivery) | Custom |\n| HyperStack | S0537 | RPC-based Windows backdoor | Custom |\n| Crutch | S0538 | Document stealer with Dropbox C2 | Custom |\n| TinyTurla | S0668 | Minimal fallback backdoor (service-based persistence) | Custom |\n| KOPILUWAK | S1075 | JavaScript reconnaissance tool | Custom |\n| IronNetInjector | S0581 | .NET\u002FIronPython malware loader | Custom |\n| PowerStallion | S0393 | PowerShell backdoor (OneDrive C2) | Custom |\n| LunarWeb | S1141 | HTTP backdoor with steganographic C2 | Custom |\n| LunarMail | S1142 | Outlook add-in backdoor (email C2) | Custom |\n| LunarLoader | S1143 | Reflective loader for Lunar toolset | Custom |\n| TwoDash | (no ATT&CK ID) | Backdoor deployed via hijacked Storm-0156 infrastructure | Custom |\n| Statuezy | (no ATT&CK ID) | Clipboard monitor deployed via hijacked infrastructure | Custom |\n| Mimikatz | S0002 | Credential dumping | Public |\n| Empire | S0363 | Post-exploitation framework (PowerShell) | Public |\n| Metasploit \u002F Meterpreter | S0261 | Post-exploitation framework | Public |\n| PsExec | S0029 | Remote execution | Public (Sysinternals) |\n| NBTscan | S0590 | NetBIOS scanner | Public |\n| certutil | S0160 | LOLBin (decode, download, certificate install) | Built-in |\n| Net \u002F nbtstat \u002F netstat \u002F Reg \u002F Systeminfo \u002F Tasklist | S0039 \u002F S0102 \u002F S0104 \u002F S0075 \u002F S0096 \u002F S0057 | LOLBins | Built-in |\n\n## Emulation guidance (Raptix)\n\n> **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never deploy kernel rootkits or destructive capabilities outside an explicitly sanctioned, isolated lab environment.\n\nMap Turla's signature plays to Raptix's own capabilities:\n\n- **Initial access — watering hole + spearphishing (T1189, T1566.001, T1566.002).** Use the phishing skill to craft targeted spearphishing emails with links to fake Adobe or legitimate-looking download pages (Mosquito pattern); use the payload-builder to create JavaScript-based droppers (KOPILUWAK pattern). For watering hole emulation, stage payloads on compromised WordPress-like infrastructure to simulate Turla's preferred initial access chain.\n- **Persistence — Exchange Transport Agent \u002F email-based C2 (T1505.002, T1071.003, T1114.002).** Where Exchange is in scope, emulate LightNeuron by deploying a Transport Agent that intercepts email flow — this is Turla's most distinctive persistence mechanism. Alternatively, deploy Outlook add-in persistence (LunarMail pattern, T1137.006) for environments where Exchange agent access is unavailable.\n- **Persistence — service masquerading + fallback (T1543.003, T1036.004).** Emulate TinyTurla by installing a minimal backdoor DLL as a Windows service with a name matching legitimate system services (e.g., `w32time.dll`). This serves as a **fallback access** channel — Turla's signature resilience pattern where minimal implants survive detection of primary tooling.\n- **Defense evasion — rootkit + hidden filesystem (T1014, T1564.005, T1027.011).** In an isolated lab, emulate Uroburos\u002FSnake's kernel-rootkit persistence with hidden NTFS virtual filesystems and Registry-stored encrypted payloads. For non-lab environments, focus on fileless storage (Registry-based payload staging) and **AMSI bypass** (T1685) patching techniques documented in Turla's PowerShell operations.\n- **C2 — Gmail\u002Femail-based channels (T1071.003, T1102.002).** Use the c2 skill to establish an **email-based C2 channel** mimicking ComRAT v4's Gmail web-UI communication: commands received as email attachments, responses exfiltrated as encrypted email attachments with `.jpg.bfe` double extensions. Add a web-service C2 profile (Dropbox\u002FGitHub) for redundancy, emulating Crutch and PowerStallion patterns.\n- **C2 — passive network implants (T1205, T1205.002).** Emulate Penquin's passive listener model: deploy an implant that does **not beacon** but instead monitors network traffic via BPF socket filters, activating only when a magic packet is received. This tests defenders' ability to detect implants that produce zero outbound C2 traffic.\n- **C2 — multi-hop P2P proxy (T1090.003, T1572).** Emulate Snake\u002FUroburos's signature P2P C2 architecture by chaining compromised internal systems as proxy nodes using encrypted custom protocols. Use **Sliver** (c2 skill) with internal pivot listeners to reproduce the multi-hop relay pattern.\n- **C2 — steganography (T1001.002).** Embed C2 commands within PDF\u002FJPEG files attached to emails, reproducing LightNeuron's steganographic communication. This tests email security controls' ability to detect malicious content hidden within otherwise legitimate-looking attachments.\n- **Credential access — domain takeover chain (T1003.001, T1003.006, T1558.001, T1550.002).** Drive the AD skill \u002F **Mimikatz** for the full Turla credential chain: LSASS dump → DCSync → golden ticket generation → pass-the-hash lateral movement. This mirrors Turla's documented domain-takeover pattern used to establish persistent domain-level access.\n- **Collection & exfil — cloud service abuse (T1567.002, T1102, T1020).** Use bash\u002FPowerShell to stage collected documents in RAR archives and exfiltrate via WebDAV to cloud storage (OneDrive, Dropbox), emulating the Crutch and ComRAT exfiltration patterns. Implement **automated collection** with scheduled transfers (T1029) to reproduce Turla's low-and-slow exfil cadence.\n- **Lateral movement — hijacking rival infrastructure (T1584.003, T1584.004).** Where multi-team engagements allow, emulate Turla's signature maneuver of **parasitizing another threat actor's C2 infrastructure** — access the simulated adversary's C2 servers to deploy your own backdoors through their existing access. This unique TTP tests whether defenders can distinguish between distinct actors operating through shared infrastructure.\n- **Defense evasion — steganographic payloads + reflective loading (T1001.002, T1620).** Combine steganographic payload delivery with reflective code loading to emulate the LunarLoader pattern — payloads hidden in image files that are decoded and reflectively loaded into memory without touching disk.\n\n## Detection & defense\n\n- **Kernel rootkit \u002F Snake (T1014, S0022):** Deploy Secure Boot with UEFI firmware integrity monitoring; use kernel-mode code integrity (KMCI\u002FHVCI); monitor for unsigned kernel drivers; alert on anomalous raw disk\u002Ffilesystem access patterns; hunt for hidden NTFS streams and virtual filesystem artifacts. The 2023 CISA advisory AA23-129A provides Snake-specific detection signatures and YARA rules.\n- **Exchange Transport Agent abuse (T1505.002, S0395):** Audit installed Exchange Transport Agents (`Get-TransportAgent`); monitor for new or modified DLLs in Exchange transport directories; alert on Exchange process spawning unexpected child processes; inspect email attachments for steganographic anomalies (oversized image\u002FPDF metadata).\n- **Email\u002FGmail C2 (T1071.003, T1102.002):** Monitor for unusual browser automation patterns accessing webmail; detect processes making authenticated Gmail\u002FOutlook web requests outside of normal user sessions; alert on encrypted attachment patterns with suspicious double extensions (`.jpg.bfe`); monitor for programmatic email draft creation.\n- **PowerShell abuse + AMSI bypass (T1059.001, T1685):** Enable PowerShell ScriptBlock logging and Module logging; monitor for `amsi.dll` patch attempts; alert on PowerShell profiles modified outside normal administrative processes; detect encoded\u002Fencrypted PowerShell scripts using `Out-EncryptedScript` patterns.\n- **Registry-based fileless storage (T1027.011):** Monitor Registry value writes to Run keys, WMI subscription stores, and unusual key paths for large binary data; alert on Registry values exceeding normal size thresholds; baseline and monitor PowerShell Profile file modifications.\n- **Passive implants \u002F traffic signaling (T1205, T1205.002):** Deploy network anomaly detection for unusual raw socket listeners; hunt for processes with BPF socket filters that don't match legitimate use (network monitoring tools); since passive implants produce no outbound traffic, focus detection on the activation packets — unusual single-packet inbound connections followed by outbound data transfers.\n- **Credential dumping (T1003.*, T1558.*):** Enable LSA protection (`RunAsPPL`) and Credential Guard; alert on LSASS handle access with `PROCESS_VM_READ`; monitor for DCSync replication requests from non-DC hosts; detect Kerberos ticket anomalies (golden ticket TGT lifetime, silver ticket service principal mismatches).\n- **Watering hole delivery (T1189):** Monitor for exploit kit indicators on partner\u002Fupstream websites; implement browser isolation for high-risk browsing; deploy Content Security Policy headers on owned web properties; hunt for iframe\u002Fredirect injections on government\u002Fdiplomatic organization websites.\n- **APT infrastructure hijacking (T1584.003, T1584.004):** During multi-APT incident response, correlate C2 infrastructure across distinct actor clusters; watch for unexplained secondary implants deployed through another actor's existing access; alert on lateral deployment from already-compromised-and-attributed C2 servers.\n- **Exfiltration to cloud services (T1567.002):** Monitor for bulk uploads to Dropbox, OneDrive, 4shared, GitHub, and Google Drive from unusual processes or outside business hours; DLP monitoring for encrypted archives (RAR\u002FZIP) being uploaded to cloud storage; alert on WebDAV PROPFIND\u002FPUT operations to external endpoints.\n- **Service-based fallback persistence (T1543.003, T1036.004):** Audit Windows services for DLLs that mimic legitimate system components; compare service DLL hashes against known-good baselines; monitor for new service installations in system directories; hunt for services with names matching built-in Windows services but with non-standard binary paths.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0010\u002F\n- https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2023-05\u002Faa23-129a_snake_malware_2.pdf\n- https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fjustice-department-announces-court-authorized-disruption-snake-malware-network-controlled\n- https:\u002F\u002Fmedia.defense.gov\u002F2019\u002FOct\u002F18\u002F2002197242\u002F-1\u002F-1\u002F0\u002FNSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F12\u002F04\u002Ffrequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage\u002F\n- https:\u002F\u002Fsecurelist.com\u002Fthe-epic-turla-operation\u002F65545\u002F\n- https:\u002F\u002Fsecurelist.com\u002Fsatellite-turla-apt-command-and-control-in-the-sky\u002F72081\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2019\u002F05\u002F29\u002Fturla-powershell-usage\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2020\u002F05\u002FESET_Turla_ComRAT.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2019\u002F05\u002FESET-LightNeuron.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Fmoon-backdoors-lunar-landing-diplomatic-missions\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2020\u002F12\u002F02\u002Fturla-crutch-keeping-back-door-open\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2018\u002F01\u002FESET_Turla_Mosquito.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2018\u002F05\u002F22\u002Fturla-mosquito-shift-towards-generic-tools\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2017\u002F08\u002Feset-gazer.pdf\n- https:\u002F\u002Fblog.talosintelligence.com\u002F2021\u002F09\u002Ftinyturla.html\n- https:\u002F\u002Fresearchcenter.paloaltonetworks.com\u002F2017\u002F05\u002Funit42-kazuar-multiplatform-espionage-backdoor-api-access\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Fironnetinjector\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Facidbox-rare-malware\u002F\n- https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Fblog\u002Fturla-galaxy-opportunity\n- https:\u002F\u002Fwww.symantec.com\u002Fblogs\u002Fthreat-intelligence\u002Fwaterbug-espionage-governments\n- https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Fturla-apt-infrastructure\n- https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20201101015247\u002Fhttps:\u002F\u002Fwww.accenture.com\u002Fus-en\u002Fblogs\u002Fcyber-defense\u002Fturla-belugasturgeon-compromises-government-entity\n- https:\u002F\u002Fwww.leonardo.com\u002Fdocuments\u002F20142\u002F10868623\u002FMalware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\n- https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fmeet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear\u002F\n- https:\u002F\u002Fcyberscoop.com\u002Fturla-infiltrates-pakistani-apt-networks-microsoft-lumen\u002F\n","# Turla (Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake) — Adversary Emulation Profile\n\nTurla (MITRE ATT&CK **G0010**) is one of the most sophisticated and long-running cyber-espionage groups in existence, attributed to Russia's Federal Security Service (FSB) **Center 16**, operating since at least 2004. Turla has compromised victims in over 50 countries across government, diplomatic, military, defense, education, research, and pharmaceutical sectors. The group is characterized by extraordinary technical depth — from the Snake\u002FUroburos kernel rootkit and satellite-based C2 hijacking to steganographic email backdoors and the audacious practice of hijacking other nation-state APTs' infrastructure. Turla's tooling spans Windows, Linux, and macOS, with a malware ecosystem (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, TinyTurla, Lunar toolset) unmatched in breadth and longevity. The 2023 FBI Operation MEDUSA takedown of the Snake peer-to-peer network — spanning 50+ countries over nearly 20 years — underscored the global scale of Turla's operations.\n\n## Attribution & motivation\n\n- **Sponsor \u002F nation:** Russian Federation — Federal Security Service (FSB), **Center 16**. CISA has formally attributed Turla \u002F Secret Blizzard to FSB Center 16. The 2023 joint FBI\u002FCISA\u002FNSA advisory (AA23-129A) detailed the Snake malware infrastructure and attributed it to FSB officers. The NSA\u002FNCSC 2019 joint advisory documented Turla's hijacking of Iranian APT infrastructure and attributed it to the same FSB unit.\n- **Motivation:** Primarily **strategic intelligence collection (espionage)** — diplomatic, military, political, and scientific intelligence aligned with Russian state interests. Turla is a pure espionage actor with no documented financially motivated or destructive campaigns; its sole objective is persistent, covert access to high-value targets for long-term intelligence gathering.\n- **Attribution confidence:** **High.** Backed by U.S. DOJ court filings (Operation MEDUSA), joint CISA\u002FNSA\u002FFBI advisories, NSA\u002FNCSC joint attributions, and consistent named vendor reporting (ESET, Kaspersky, Microsoft, Symantec\u002FBroadcom, Palo Alto Unit 42, Mandiant, Cisco Talos, Accenture).\n\n## Targeting\n\n- **Sectors:** Government and diplomatic bodies (especially ministries of foreign affairs, embassies); military and defense; education and research institutions; pharmaceutical companies; think tanks and NGOs; media.\n- **Regions:** Primary focus on **Europe** (Eastern and Western — Germany, France, the Baltics, Balkans, Caucasus, Ukraine) and **Central Asia**. Significant targeting of **Middle East, South Asia** (via hijacked APT infrastructure), and **NATO member states** broadly. Operations documented in 50+ countries worldwide.\n- **Victim profile:** Entities whose networks yield diplomatic, military, and political intelligence — embassies, foreign ministries, parliaments, defense agencies, and academic research institutions. Turla favors long-dwell-time persistence in high-value networks over smash-and-grab operations.\n\n## Notable campaigns\n\n- **2008 — Agent.BTZ \u002F Operation Buckshot Yankee.** USB worm (Agent.BTZ) spread via infected flash drive at a U.S. Central Command base in the Middle East, infecting approximately 300,000 DoD computers across classified and unclassified networks. Described as the \"worst breach of U.S. military computers in history,\" it led to a 14-month cleanup and the creation of U.S. Cyber Command. Kaspersky Lab later documented shared XOR keys between Agent.BTZ and Turla malware. (wikipedia.org \u002F securelist.com)\n- **2014-08 — Epic Turla (Snake\u002FUroburos discovery).** Kaspersky's Global Research team publicly detailed the Epic Turla operation, revealing the Snake\u002FUroburos rootkit framework and documenting compromises across 45+ countries targeting government and diplomatic entities. The research established Turla as one of the most advanced persistent threats operating at the time. (securelist.com)\n- **2015-09 — Satellite Turla (DVB-S C2 hijacking).** Kaspersky revealed that Turla had been hijacking unencrypted DVB-S satellite internet downlinks — primarily from Middle Eastern and African ISPs — to mask C2 server locations. Evidence suggested the technique had been in use since approximately 2007. The method provided exceptional anonymity by abusing legitimate satellite subscribers' IP addresses as C2 endpoints. (securelist.com \u002F securityweek.com)\n- **2019-05 — LightNeuron Exchange backdoor.** ESET documented LightNeuron, a backdoor deployed as a Microsoft Exchange Transport Agent, enabling Turla to intercept, modify, and exfiltrate email traffic in real time. The implant used steganography to embed C2 commands within PDF and JPEG email attachments. Deployed against ministries of foreign affairs in Eastern Europe and a Central Asian diplomatic entity. (welivesecurity.com \u002F ESET)\n- **2019-10 — Hijacking Iranian APT (OilRig) infrastructure.** Joint NSA\u002FNCSC advisory revealed that Turla had compromised the C2 infrastructure of the Iranian APT group OilRig (APT34), using their VPS servers and even deploying their own implants through OilRig's existing access to victims. This marked the first publicly documented case of one nation-state APT parasitizing another's operations. (media.defense.gov \u002F NSA-NCSC advisory)\n- **2020-05 — ComRAT v4 with Gmail C2.** ESET documented ComRAT v4, the latest evolution of the decade-old ComRAT\u002FAgent.BTZ lineage, now using the Gmail web interface as a C2 channel. The backdoor received commands and exfiltrated data via email attachments, bypassing network security controls. Targets included foreign ministries in Eastern Europe and a Caucasus parliament. (welivesecurity.com \u002F ESET)\n- **2021-09 — TinyTurla.** Cisco Talos disclosed TinyTurla, a minimal backdoor installed as a Windows service disguised as a legitimate system component. Designed as a fallback access mechanism that persists even when primary implants are detected and removed. Deployed against targets in the U.S., Germany, and Afghanistan. (blog.talosintelligence.com)\n- **2023-05 — Operation MEDUSA (Snake infrastructure takedown).** FBI-led Operation MEDUSA disabled Turla's Snake malware peer-to-peer network using the custom-built PERSEUS tool, which issued self-destruct commands mimicking Snake's own session authentication protocol. The operation, authorized by a federal search warrant, disrupted Snake infrastructure across 50+ countries that had been operational for nearly 20 years. (justice.gov \u002F CISA AA23-129A)\n- **2024-12 — Hijacking Pakistani APT (Storm-0156) infrastructure.** Microsoft and Lumen Black Lotus Labs revealed that Turla (Secret Blizzard) had compromised 33 C2 servers belonging to Pakistani APT Storm-0156 since late 2022. Turla commandeered Storm-0156's CrimsonRAT backdoors to deploy its own TwoDash and Statuezy implants within Afghan government networks (Ministry of Foreign Affairs, intelligence directorate) and accessed CrimsonRAT infections on targets in India. This marked the fourth documented instance of Turla parasitizing another threat actor's infrastructure. (microsoft.com \u002F cyberscoop.com)\n\n## TTPs by ATT&CK tactic\n\n### Resource Development\n- **T1583.006** — Acquire infrastructure (web services): created accounts on Dropbox, GitHub, Pastebin, and Google (Gmail) for C2 communications and data exfiltration.\n- **T1584.003** — Compromise infrastructure (VPS): hijacked the VPS infrastructure of compromised Iranian APT OilRig\u002FAPT34 for Turla's own operations.\n- **T1584.004** — Compromise infrastructure (server): extensively used compromised servers — particularly WordPress sites — as C2 relay nodes.\n- **T1584.006** — Compromise infrastructure (web services): co-opted compromised WordPress sites for C2 hosting.\n- **T1587.001** — Develop capabilities (malware): developed an extensive custom malware ecosystem spanning two decades (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, Gazer, Mosquito, TinyTurla, Lunar toolset, Epic, HyperStack, Crutch, KOPILUWAK).\n- **T1588.001** — Obtain capabilities (malware): obtained and reused malware from compromised threat actors, notably commandeering OilRig tools and Storm-0156's CrimsonRAT.\n- **T1588.002** — Obtain capabilities (tool): obtained and customized publicly available tools including Mimikatz, Metasploit\u002FMeterpreter, PowerShell Empire, PowerSploit, PsExec, and NBTscan.\n\n### Initial Access\n- **T1189** — Drive-by compromise: signature Turla technique; conducted watering hole attacks on government and embassy websites to deliver exploits and backdoors (Epic Turla campaign, ComRAT delivery).\n- **T1566.001** — Spearphishing attachment: delivered weaponized documents and archives (KOPILUWAK JavaScript dropper via spearphishing attachments).\n- **T1566.002** — Spearphishing link: sent phishing emails with links to seemingly legitimate domains (e.g., fake Adobe download pages) to trick targets into downloading Mosquito installer malware.\n- **T1204.001 \u002F T1204.002** — User execution (malicious link \u002F malicious file): relied on user execution of phishing links and weaponized document files to establish initial footholds.\n- **T1078.003** — Valid accounts (local): abused local accounts with reused passwords across victim networks for initial and sustained access.\n\n### Execution\n- **T1059.001** — PowerShell: extensively used PowerShell for post-compromise operations, including Empire PSInject for reflective payload injection, PowerSploit's `Out-EncryptedScript.ps1` for encrypted payloads, and custom PowerShell backdoors with RPC-based C2. ESET documented Turla's comprehensive PowerShell-based toolchain in 2019.\n- **T1059.003** — Windows Command Shell: RPC backdoors and multiple malware families (ComRAT, Uroburos, TinyTurla, LunarWeb, LightNeuron, Kazuar) used `cmd.exe` for command execution.\n- **T1059.004** — Unix shell: Kazuar (multiplatform) and Penquin (Linux backdoor) executed commands via Unix shell on Linux targets.\n- **T1059.005** — Visual Basic: used VBS scripts in operations (Waterbug\u002FSymantec reporting) and LunarMail Outlook add-in backdoor used VBA.\n- **T1059.006** — Python: IronNetInjector toolchain used IronPython scripts to drop and execute payloads.\n- **T1059.007** — JavaScript: deployed various JavaScript-based backdoors (Mosquito installer, KOPILUWAK JavaScript reconnaissance tool).\n- **T1047** — Windows Management Instrumentation: used WMI via LunarWeb, Kazuar, Mosquito, and Empire for execution and reconnaissance.\n- **T1106** — Native API: RPC backdoors and multiple implants (Uroburos, Mosquito, TinyTurla, HyperStack) made direct Windows API calls for execution, AMSI bypasses, and IPC.\n- **T1569.002** — Service execution: TinyTurla and Net utility used for executing payloads via Windows services.\n\n### Persistence\n- **T1547.001** — Registry Run keys \u002F Startup folder: JavaScript backdoors set `HKLM\\...\\Run` keys; Metasploit shellcode executables saved to Startup folder; Gazer, Kazuar, and Mosquito used Run key persistence.\n- **T1547.004** — Winlogon Helper DLL: established persistence via `HKCU\\...\\Winlogon` Shell value modifications (Mosquito installer, Gazer).\n- **T1546.003** — WMI Event Subscription: PowerShell toolchain used WMI event filters and consumers for persistent backdoor activation.\n- **T1546.013** — PowerShell Profile: modified PowerShell profiles to execute malicious payloads on interpreter startup, providing persistence through legitimate PowerShell usage.\n- **T1546.015** — COM hijacking: ComRAT and Mosquito hijacked COM objects for persistence and execution.\n- **T1543.003** — Windows service: Carbon, Kazuar, Uroburos\u002FSnake, and TinyTurla installed as Windows services for persistent execution; TinyTurla masqueraded as a legitimate Windows Time service component.\n- **T1505.002** — Transport Agent: LightNeuron installed as a Microsoft Exchange Transport Agent, intercepting all email traffic through the server — one of the most novel persistence mechanisms documented.\n- **T1053.005** — Scheduled task: Carbon, ComRAT, Crutch, Gazer, and IronNetInjector used Windows scheduled tasks for periodic execution.\n- **T1053.003** — Cron: Penquin Linux backdoor used cron jobs for persistence on Linux targets.\n- **T1137.006** — Office add-ins: LunarLoader and LunarMail persisted as Outlook add-ins, executing whenever the Outlook application launched.\n- **T1574.001** — DLL hijacking: Crutch backdoor abused DLL search-order hijacking for persistence and execution.\n\n### Privilege Escalation\n- **T1068** — Exploitation for privilege escalation: exploited VBoxDrv.sys driver vulnerabilities to achieve kernel-mode execution (AcidBox reporting by Unit 42).\n- **T1055 \u002F T1055.001** — Process injection \u002F DLL injection: used PowerSploit's `Invoke-ReflectivePEInjection.ps1` for reflective PE injection; Metasploit reflective DLL injection for privilege escalation; IronNetInjector, Kazuar, Uroburos, Carbon, and Gazer used DLL injection.\n- **T1134.002** — Access token manipulation (Create Process with Token): RPC backdoors impersonated or stole process tokens before executing commands.\n- **T1553.006** — Code Signing Policy Modification: modified kernel memory variables to disable Driver Signature Enforcement after achieving kernel-mode privileges, enabling unsigned driver loading (Turla Driver Loader).\n\n### Defense Evasion\n- **T1014** — Rootkit: Uroburos\u002FSnake operated as a kernel-mode rootkit with hidden filesystems, custom encrypted peer-to-peer networking, and covert protocol impersonation — active for nearly 20 years before the FBI disrupted it.\n- **T1027 \u002F T1027.002 \u002F T1027.005** — Obfuscation \u002F software packing \u002F indicator removal from tools: Uroburos used software packing; Gazer versions had IoC strings (mutex names, named pipes) deliberately obfuscated between variants; Penquin removed identifiable strings.\n- **T1027.009** — Embedded payloads: ComRAT and Uroburos embedded secondary payloads within their binaries.\n- **T1027.010** — Command obfuscation: used salted 3DES encryption (via PowerSploit), random variable names, and base64 encoding to obfuscate PowerShell commands.\n- **T1027.011** — Fileless storage: stored encrypted payloads in Windows Registry values (PowerShell backdoors, Mosquito, TinyTurla, Uroburos, ComRAT).\n- **T1027.013** — Encrypted\u002Fencoded file: multiple families (Gazer, Mosquito, Penquin, LightNeuron, LunarWeb, LunarMail, IronNetInjector) used encrypted files for payload storage and transport.\n- **T1036.004 \u002F T1036.005** — Masquerading: TinyTurla masqueraded as a Windows Time service DLL (`w32time.dll`); LunarWeb components mimicked Zabbix agent logs; LightNeuron and Penquin matched legitimate resource names and locations.\n- **T1140** — Deobfuscate\u002FDecode: custom decryption routines pulled keys and salts from WMI filters or PowerShell profiles to decode encrypted payloads at runtime.\n- **T1112** — Modify Registry: stored payloads, configuration data, and C2 parameters in Registry values across multiple malware families.\n- **T1070.004 \u002F T1070.006 \u002F T1070.008** — Indicator removal: file deletion (multiple families); timestomping (Gazer, PowerStallion); clearing mailbox data (LunarMail removed evidence of C2 emails).\n- **T1564.004** — NTFS file attributes: Gazer hid data in alternate NTFS data streams.\n- **T1564.005** — Hidden file system: ComRAT and Uroburos\u002FSnake maintained hidden virtual file systems for covert data storage.\n- **T1564.012** — File\u002FPath exclusions: LunarWeb installed files into directories excluded from antivirus scanning.\n- **T1218.011** — Rundll32: Mosquito used Rundll32 for proxy execution of malicious DLLs.\n- **T1685** — Disable or Modify Tools: PowerShell scripts patched the in-memory `amsi.dll` to bypass Windows AMSI (Antimalware Scan Interface).\n- **T1620** — Reflective code loading: LunarLoader and Uroburos used reflective loading to execute payloads directly in memory.\n- **T1497.003** — Virtualization\u002FSandbox evasion (time-based): LunarWeb used time-based checks to detect analysis environments.\n- **T1001.001 \u002F T1001.002 \u002F T1001.003** — Data obfuscation: Uroburos injected junk data and used protocol impersonation (HTTP to masquerade raw TCP); LightNeuron, LunarWeb, and LunarMail used **steganography** to embed C2 commands in PDF and JPEG email attachments.\n\n### Credential Access\n- **T1110** — Brute force: attempted network authentication with predefined password lists using `net use` commands.\n- **T1555.004** — Windows Credential Manager: gathered stored credentials from Windows Credential Manager.\n- **T1003.001 \u002F T1003.002 \u002F T1003.004 \u002F T1003.006** — OS credential dumping: used Mimikatz for LSASS memory dumping, SAM database extraction, LSA secrets access, and **DCSync** replication attacks to obtain domain credentials.\n- **T1056.001** — Keylogging: Snake\u002FUroburos and Empire deployed keyloggers alongside primary implants to capture authentication credentials.\n- **T1558.001 \u002F T1558.002** — Kerberos ticket forging: used Mimikatz to generate **golden tickets** (domain-wide persistence) and **silver tickets** (service-specific access) via Empire\u002FMimikatz integration.\n- **T1550.002** — Pass the hash: used Mimikatz for pass-the-hash lateral movement within compromised domains.\n\n### Discovery\n- **T1087.001 \u002F T1087.002** — Account discovery (local\u002Fdomain): enumerated accounts with `net user`, `net user \u002Fdomain`; HyperStack, Epic, and Kazuar performed local account enumeration.\n- **T1083** — File and directory discovery: surveyed `%TEMP%`, desktop, Program Files, and Recent directories; RPC backdoors searched for `lPH*.dll` pattern; multiple malware families perform targeted file discovery.\n- **T1615** — Group Policy discovery: used `gpresult` to enumerate Group Policy configuration.\n- **T1120** — Peripheral device discovery: used `fsutil fsinfo drives` to list connected drives.\n- **T1069.001 \u002F T1069.002** — Permission groups discovery: `net localgroup Administrators`, `net group \"Domain Admins\" \u002Fdomain` for privilege mapping.\n- **T1057** — Process discovery: `tasklist \u002Fv` and RPC backdoor enumeration of processes by open ports\u002Fnamed pipes; used across Carbon, Epic, Kazuar, Mosquito, LunarWeb, KOPILUWAK, PowerStallion, IronNetInjector.\n- **T1012** — Query Registry: `reg query` for system enumeration; retrieved stored PowerShell payloads from Registry; checked null-session named pipe configurations.\n- **T1018** — Remote system discovery: `net view`, `net view \u002FDOMAIN`, `net group \"Domain Computers\" \u002Fdomain`, `net group \"Domain Controllers\" \u002Fdomain`, `net group \"Exchange Servers\" \u002Fdomain` for network mapping.\n- **T1518.001** — Security software discovery: enumerated security products and logging configurations to assess detection risk.\n- **T1082** — System information discovery: `systeminfo`, `set` commands; used across Epic, Gazer, Kazuar, LightNeuron, LunarWeb, Penquin, Uroburos.\n- **T1016 \u002F T1016.001** — Network configuration \u002F internet connection discovery: `arp -a`, `nbtstat -n`, `net config`, `ipconfig \u002Fall`, `route`, NBTscan, and `tracert` for network reconnaissance.\n- **T1049** — System network connections discovery: `netstat -an`, `net use`, `net file`, `net session`; RPC backdoors enumerated TCP connections via `GetTcpTable2` API.\n- **T1007** — System service discovery: `tasklist \u002Fsvc` for service-to-process mapping.\n- **T1124** — System time discovery: `net time` command.\n- **T1201** — Password policy discovery: `net accounts`, `net accounts \u002Fdomain`.\n- **T1135** — Network share discovery: via KOPILUWAK, LunarWeb, Net utility, and Empire.\n- **T1033** — System owner\u002Fuser discovery: multiple families (Epic, Gazer, Kazuar, KOPILUWAK, LunarWeb, Mosquito, NBTscan) identified logged-in users and system owners.\n- **T1010** — Application window discovery: Kazuar enumerated open application windows.\n- **T1046** — Network service discovery: NBTscan for NetBIOS and network service enumeration.\n- **T1680** — Local storage discovery: Epic, Kazuar, KOPILUWAK, and Penquin performed local storage device enumeration.\n\n### Lateral Movement\n- **T1021.002** — SMB\u002FWindows Admin Shares: used `net use` for lateral connections and PsExec for remote service execution across internal networks.\n- **T1570** — Lateral tool transfer: RPC backdoors transferred files between victim machines on the local network; PsExec used for lateral tool deployment.\n- **T1550.002** — Pass the hash: Mimikatz-based pass-the-hash for domain-wide lateral movement.\n\n### Collection\n- **T1005** — Data from local system: RPC backdoors, Kazuar, KOPILUWAK, LightNeuron, TinyTurla, and Uroburos uploaded files from victim machines.\n- **T1025** — Data from removable media: RPC backdoors and Crutch collected files from USB thumb drives; Uroburos targeted removable media.\n- **T1213.006** — Data from information repositories (databases): used a custom .NET tool to collect documents from an organization's internal central database.\n- **T1560.001** — Archive via utility: encrypted stolen USB drive files into RAR archives; LunarWeb used compression utilities for data archival.\n- **T1119** — Automated collection: Crutch and LightNeuron performed automated file collection from local and removable storage.\n- **T1074.001** — Local data staging: Carbon, KOPILUWAK, LightNeuron, Kazuar, Crutch, and LunarMail staged collected data locally before exfiltration.\n- **T1113** — Screen capture: Kazuar and LunarMail captured screenshots for intelligence collection.\n- **T1125** — Video capture: Kazuar included webcam video capture capability.\n- **T1114.001 \u002F T1114.002** — Email collection (local\u002Fremote): LunarMail collected local Outlook emails; LightNeuron intercepted and collected email traffic in transit through Exchange Transport Agent access.\n- **T1056.001** — Keylogging: Snake and Empire keyloggers captured typed credentials and communications.\n\n### Command & Control\n- **T1071.001** — Web protocols (HTTP\u002FHTTPS): primary C2 channel for most malware families (Carbon, ComRAT, Epic, Gazer, Kazuar, KOPILUWAK, LunarWeb, Mosquito, TinyTurla, Uroburos).\n- **T1071.002** — File transfer protocols: Kazuar used FTP for C2 communications.\n- **T1071.003** — Mail protocols: **signature Turla technique** — ComRAT v4 used the Gmail web interface for C2; LightNeuron and LunarMail used email (SMTP\u002FIMAP) as C2 channels; Uroburos supported mail-protocol-based C2; CrowdStrike documented multiple backdoors communicating via email attachments.\n- **T1071.004** — DNS: Uroburos\u002FSnake included DNS-based C2 capabilities.\n- **T1102 \u002F T1102.002** — Web service \u002F bidirectional communication: used Pastebin, Dropbox, GitHub, Google Apps Script, and OneDrive for C2 and data exfiltration; JavaScript backdoors used Google Apps Script as a full C2 server.\n- **T1573.001 \u002F T1573.002** — Encrypted channel (symmetric\u002Fasymmetric): Carbon, Gazer, LunarWeb, Uroburos used asymmetric (RSA) key exchange; Epic, Mosquito, Carbon used symmetric encryption (AES, 3DES, custom XOR-based schemes); Snake\u002FUroburos implemented custom encrypted P2P protocols.\n- **T1090 \u002F T1090.001 \u002F T1090.003** — Proxy \u002F internal proxy \u002F multi-hop proxy: RPC backdoors included local UPnP proxies; TinyTurla and Kazuar compromised internal systems as proxy relays; Uroburos\u002FSnake used **multi-hop P2P proxy chains** across compromised nodes in 50+ countries.\n- **T1095** — Non-application layer protocol: Uroburos, Penquin, LunarMail, and Carbon used raw TCP\u002Fcustom protocols for C2 communications.\n- **T1572** — Protocol tunneling: Uroburos and LunarWeb tunneled C2 traffic through legitimate protocols.\n- **T1008** — Fallback channels: Uroburos, Kazuar, TinyTurla, and Crutch implemented multiple fallback C2 channels for resilience.\n- **T1104** — Multi-stage channels: Uroburos and LunarWeb used multi-stage C2 architecture with initial check-in servers routing to operational C2.\n- **T1105** — Ingress tool transfer: Meterpreter shellcode download, tool deployment across all major families.\n- **T1132.001 \u002F T1132.002** — Data encoding (standard\u002Fnon-standard): Kazuar and LunarWeb used base64 standard encoding; Uroburos used custom non-standard encoding for C2 data.\n- **T1029** — Scheduled transfer: ComRAT, Crutch, Kazuar, LightNeuron, and TinyTurla scheduled data exfiltration at fixed intervals.\n- **T1030** — Data transfer size limits: LunarWeb split exfiltration data into size-limited chunks.\n- **T1205 \u002F T1205.002** — Traffic signaling \u002F socket filters: Penquin and Uroburos used **passive network implants** that listened for magic-packet triggers rather than actively beaconing — Penquin used BPF socket filters to detect activation packets, making the backdoor virtually invisible to network monitoring.\n\n### Exfiltration\n- **T1041** — Exfiltration over C2 channel: primary exfil method for KOPILUWAK, LightNeuron, LunarMail, Penquin, TinyTurla, and Crutch.\n- **T1567.002** — Exfiltration to cloud storage: Crutch used WebDAV to upload to cloud drives; ComRAT exfiltrated to OneDrive and 4shared; Turla operations leveraged Dropbox and GitHub for data staging.\n- **T1048.003** — Exfiltration over unencrypted non-C2 protocol: Carbon exfiltrated data over alternate HTTP channels distinct from the primary C2.\n- **T1020** — Automated exfiltration: Crutch and LightNeuron automated the exfiltration of collected files without operator interaction.\n\n### Impact\n- **T1485** — Data destruction: Kazuar includes a self-destruct capability that can wipe collected data and the malware itself to cover tracks.\n\n## Signature tooling & malware\n\n| Name | ATT&CK ID | Type | Public\u002FCustom |\n|---|---|---|---|\n| Uroburos \u002F Snake | S0022 | **Kernel rootkit** + P2P C2 network (20-year lifespan) | Custom |\n| Carbon | S0335 | Second-stage modular framework | Custom |\n| ComRAT (Agent.BTZ lineage) | S0126 | Backdoor with Gmail web-UI C2 | Custom |\n| Kazuar | S0265 | Multiplatform espionage backdoor (Windows\u002FLinux) | Custom |\n| LightNeuron | S0395 | Exchange Transport Agent backdoor (steganographic C2) | Custom |\n| Penquin | S0587 | Linux backdoor (passive, BPF-based activation) | Custom |\n| Gazer (WhiteBear) | S0168 | Second-stage Windows backdoor | Custom |\n| Mosquito | S0256 | Windows installer\u002Fbackdoor | Custom |\n| Epic | S0091 | First-stage Windows implant (watering hole delivery) | Custom |\n| HyperStack | S0537 | RPC-based Windows backdoor | Custom |\n| Crutch | S0538 | Document stealer with Dropbox C2 | Custom |\n| TinyTurla | S0668 | Minimal fallback backdoor (service-based persistence) | Custom |\n| KOPILUWAK | S1075 | JavaScript reconnaissance tool | Custom |\n| IronNetInjector | S0581 | .NET\u002FIronPython malware loader | Custom |\n| PowerStallion | S0393 | PowerShell backdoor (OneDrive C2) | Custom |\n| LunarWeb | S1141 | HTTP backdoor with steganographic C2 | Custom |\n| LunarMail | S1142 | Outlook add-in backdoor (email C2) | Custom |\n| LunarLoader | S1143 | Reflective loader for Lunar toolset | Custom |\n| TwoDash | (no ATT&CK ID) | Backdoor deployed via hijacked Storm-0156 infrastructure | Custom |\n| Statuezy | (no ATT&CK ID) | Clipboard monitor deployed via hijacked infrastructure | Custom |\n| Mimikatz | S0002 | Credential dumping | Public |\n| Empire | S0363 | Post-exploitation framework (PowerShell) | Public |\n| Metasploit \u002F Meterpreter | S0261 | Post-exploitation framework | Public |\n| PsExec | S0029 | Remote execution | Public (Sysinternals) |\n| NBTscan | S0590 | NetBIOS scanner | Public |\n| certutil | S0160 | LOLBin (decode, download, certificate install) | Built-in |\n| Net \u002F nbtstat \u002F netstat \u002F Reg \u002F Systeminfo \u002F Tasklist | S0039 \u002F S0102 \u002F S0104 \u002F S0075 \u002F S0096 \u002F S0057 | LOLBins | Built-in |\n\n## Emulation guidance (Raptix)\n\n> **Authorized-use caveat:** Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never deploy kernel rootkits or destructive capabilities outside an explicitly sanctioned, isolated lab environment.\n\nMap Turla's signature plays to Raptix's own capabilities:\n\n- **Initial access — watering hole + spearphishing (T1189, T1566.001, T1566.002).** Use the phishing skill to craft targeted spearphishing emails with links to fake Adobe or legitimate-looking download pages (Mosquito pattern); use the payload-builder to create JavaScript-based droppers (KOPILUWAK pattern). For watering hole emulation, stage payloads on compromised WordPress-like infrastructure to simulate Turla's preferred initial access chain.\n- **Persistence — Exchange Transport Agent \u002F email-based C2 (T1505.002, T1071.003, T1114.002).** Where Exchange is in scope, emulate LightNeuron by deploying a Transport Agent that intercepts email flow — this is Turla's most distinctive persistence mechanism. Alternatively, deploy Outlook add-in persistence (LunarMail pattern, T1137.006) for environments where Exchange agent access is unavailable.\n- **Persistence — service masquerading + fallback (T1543.003, T1036.004).** Emulate TinyTurla by installing a minimal backdoor DLL as a Windows service with a name matching legitimate system services (e.g., `w32time.dll`). This serves as a **fallback access** channel — Turla's signature resilience pattern where minimal implants survive detection of primary tooling.\n- **Defense evasion — rootkit + hidden filesystem (T1014, T1564.005, T1027.011).** In an isolated lab, emulate Uroburos\u002FSnake's kernel-rootkit persistence with hidden NTFS virtual filesystems and Registry-stored encrypted payloads. For non-lab environments, focus on fileless storage (Registry-based payload staging) and **AMSI bypass** (T1685) patching techniques documented in Turla's PowerShell operations.\n- **C2 — Gmail\u002Femail-based channels (T1071.003, T1102.002).** Use the c2 skill to establish an **email-based C2 channel** mimicking ComRAT v4's Gmail web-UI communication: commands received as email attachments, responses exfiltrated as encrypted email attachments with `.jpg.bfe` double extensions. Add a web-service C2 profile (Dropbox\u002FGitHub) for redundancy, emulating Crutch and PowerStallion patterns.\n- **C2 — passive network implants (T1205, T1205.002).** Emulate Penquin's passive listener model: deploy an implant that does **not beacon** but instead monitors network traffic via BPF socket filters, activating only when a magic packet is received. This tests defenders' ability to detect implants that produce zero outbound C2 traffic.\n- **C2 — multi-hop P2P proxy (T1090.003, T1572).** Emulate Snake\u002FUroburos's signature P2P C2 architecture by chaining compromised internal systems as proxy nodes using encrypted custom protocols. Use **Sliver** (c2 skill) with internal pivot listeners to reproduce the multi-hop relay pattern.\n- **C2 — steganography (T1001.002).** Embed C2 commands within PDF\u002FJPEG files attached to emails, reproducing LightNeuron's steganographic communication. This tests email security controls' ability to detect malicious content hidden within otherwise legitimate-looking attachments.\n- **Credential access — domain takeover chain (T1003.001, T1003.006, T1558.001, T1550.002).** Drive the AD skill \u002F **Mimikatz** for the full Turla credential chain: LSASS dump → DCSync → golden ticket generation → pass-the-hash lateral movement. This mirrors Turla's documented domain-takeover pattern used to establish persistent domain-level access.\n- **Collection & exfil — cloud service abuse (T1567.002, T1102, T1020).** Use bash\u002FPowerShell to stage collected documents in RAR archives and exfiltrate via WebDAV to cloud storage (OneDrive, Dropbox), emulating the Crutch and ComRAT exfiltration patterns. Implement **automated collection** with scheduled transfers (T1029) to reproduce Turla's low-and-slow exfil cadence.\n- **Lateral movement — hijacking rival infrastructure (T1584.003, T1584.004).** Where multi-team engagements allow, emulate Turla's signature maneuver of **parasitizing another threat actor's C2 infrastructure** — access the simulated adversary's C2 servers to deploy your own backdoors through their existing access. This unique TTP tests whether defenders can distinguish between distinct actors operating through shared infrastructure.\n- **Defense evasion — steganographic payloads + reflective loading (T1001.002, T1620).** Combine steganographic payload delivery with reflective code loading to emulate the LunarLoader pattern — payloads hidden in image files that are decoded and reflectively loaded into memory without touching disk.\n\n## Detection & defense\n\n- **Kernel rootkit \u002F Snake (T1014, S0022):** Deploy Secure Boot with UEFI firmware integrity monitoring; use kernel-mode code integrity (KMCI\u002FHVCI); monitor for unsigned kernel drivers; alert on anomalous raw disk\u002Ffilesystem access patterns; hunt for hidden NTFS streams and virtual filesystem artifacts. The 2023 CISA advisory AA23-129A provides Snake-specific detection signatures and YARA rules.\n- **Exchange Transport Agent abuse (T1505.002, S0395):** Audit installed Exchange Transport Agents (`Get-TransportAgent`); monitor for new or modified DLLs in Exchange transport directories; alert on Exchange process spawning unexpected child processes; inspect email attachments for steganographic anomalies (oversized image\u002FPDF metadata).\n- **Email\u002FGmail C2 (T1071.003, T1102.002):** Monitor for unusual browser automation patterns accessing webmail; detect processes making authenticated Gmail\u002FOutlook web requests outside of normal user sessions; alert on encrypted attachment patterns with suspicious double extensions (`.jpg.bfe`); monitor for programmatic email draft creation.\n- **PowerShell abuse + AMSI bypass (T1059.001, T1685):** Enable PowerShell ScriptBlock logging and Module logging; monitor for `amsi.dll` patch attempts; alert on PowerShell profiles modified outside normal administrative processes; detect encoded\u002Fencrypted PowerShell scripts using `Out-EncryptedScript` patterns.\n- **Registry-based fileless storage (T1027.011):** Monitor Registry value writes to Run keys, WMI subscription stores, and unusual key paths for large binary data; alert on Registry values exceeding normal size thresholds; baseline and monitor PowerShell Profile file modifications.\n- **Passive implants \u002F traffic signaling (T1205, T1205.002):** Deploy network anomaly detection for unusual raw socket listeners; hunt for processes with BPF socket filters that don't match legitimate use (network monitoring tools); since passive implants produce no outbound traffic, focus detection on the activation packets — unusual single-packet inbound connections followed by outbound data transfers.\n- **Credential dumping (T1003.*, T1558.*):** Enable LSA protection (`RunAsPPL`) and Credential Guard; alert on LSASS handle access with `PROCESS_VM_READ`; monitor for DCSync replication requests from non-DC hosts; detect Kerberos ticket anomalies (golden ticket TGT lifetime, silver ticket service principal mismatches).\n- **Watering hole delivery (T1189):** Monitor for exploit kit indicators on partner\u002Fupstream websites; implement browser isolation for high-risk browsing; deploy Content Security Policy headers on owned web properties; hunt for iframe\u002Fredirect injections on government\u002Fdiplomatic organization websites.\n- **APT infrastructure hijacking (T1584.003, T1584.004):** During multi-APT incident response, correlate C2 infrastructure across distinct actor clusters; watch for unexplained secondary implants deployed through another actor's existing access; alert on lateral deployment from already-compromised-and-attributed C2 servers.\n- **Exfiltration to cloud services (T1567.002):** Monitor for bulk uploads to Dropbox, OneDrive, 4shared, GitHub, and Google Drive from unusual processes or outside business hours; DLP monitoring for encrypted archives (RAR\u002FZIP) being uploaded to cloud storage; alert on WebDAV PROPFIND\u002FPUT operations to external endpoints.\n- **Service-based fallback persistence (T1543.003, T1036.004):** Audit Windows services for DLLs that mimic legitimate system components; compare service DLL hashes against known-good baselines; monitor for new service installations in system directories; hunt for services with names matching built-in Windows services but with non-standard binary paths.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0010\u002F\n- https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2023-05\u002Faa23-129a_snake_malware_2.pdf\n- https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fjustice-department-announces-court-authorized-disruption-snake-malware-network-controlled\n- https:\u002F\u002Fmedia.defense.gov\u002F2019\u002FOct\u002F18\u002F2002197242\u002F-1\u002F-1\u002F0\u002FNSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F12\u002F04\u002Ffrequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage\u002F\n- https:\u002F\u002Fsecurelist.com\u002Fthe-epic-turla-operation\u002F65545\u002F\n- https:\u002F\u002Fsecurelist.com\u002Fsatellite-turla-apt-command-and-control-in-the-sky\u002F72081\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2019\u002F05\u002F29\u002Fturla-powershell-usage\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2020\u002F05\u002FESET_Turla_ComRAT.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2019\u002F05\u002FESET-LightNeuron.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Fmoon-backdoors-lunar-landing-diplomatic-missions\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2020\u002F12\u002F02\u002Fturla-crutch-keeping-back-door-open\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2018\u002F01\u002FESET_Turla_Mosquito.pdf\n- https:\u002F\u002Fwww.welivesecurity.com\u002F2018\u002F05\u002F22\u002Fturla-mosquito-shift-towards-generic-tools\u002F\n- https:\u002F\u002Fwww.welivesecurity.com\u002Fwp-content\u002Fuploads\u002F2017\u002F08\u002Feset-gazer.pdf\n- https:\u002F\u002Fblog.talosintelligence.com\u002F2021\u002F09\u002Ftinyturla.html\n- https:\u002F\u002Fresearchcenter.paloaltonetworks.com\u002F2017\u002F05\u002Funit42-kazuar-multiplatform-espionage-backdoor-api-access\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Fironnetinjector\u002F\n- https:\u002F\u002Funit42.paloaltonetworks.com\u002Facidbox-rare-malware\u002F\n- https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Fblog\u002Fturla-galaxy-opportunity\n- https:\u002F\u002Fwww.symantec.com\u002Fblogs\u002Fthreat-intelligence\u002Fwaterbug-espionage-governments\n- https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Fturla-apt-infrastructure\n- https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20201101015247\u002Fhttps:\u002F\u002Fwww.accenture.com\u002Fus-en\u002Fblogs\u002Fcyber-defense\u002Fturla-belugasturgeon-compromises-government-entity\n- https:\u002F\u002Fwww.leonardo.com\u002Fdocuments\u002F20142\u002F10868623\u002FMalware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\n- https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fmeet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear\u002F\n- https:\u002F\u002Fcyberscoop.com\u002Fturla-infiltrates-pakistani-apt-networks-microsoft-lumen\u002F\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"turla, venomous-bear, secret-blizzard, waterbug, krypton, snake, fsb, russia, espionage, nation-state, g0010, adversary-emulation, mitre-attack","adversary-emulation","Turla, Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake, IRON HUNTER, BELUGASTURGEON, WhiteBear, FSB Center 16, G0010, Russian FSB espionage emulation, Snake rootkit, Uroburos, ComRAT, Carbon framework, Kazuar backdoor, LightNeuron Exchange, Penquin Linux, TinyTurla, satellite C2, watering hole attacks, hijacking other APT infrastructure, DNS-over-HTTPS C2, Gmail C2","T1583.006, T1584.003, T1584.004, T1584.006, T1587.001, T1588.001, T1588.002, T1189, T1566.001, T1566.002, T1204.001, T1204.002, T1078.003, T1059.001, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1047, T1106, T1569.002, T1547.001, T1547.004, T1546.003, T1546.013, T1546.015, T1543.003, T1505.002, T1053.003, T1053.005, T1137.006, T1574.001, T1068, T1055, T1055.001, T1134.002, T1553.006, T1014, T1027, T1027.002, T1027.005, T1027.009, T1027.010, T1027.011, T1027.013, T1036.004, T1036.005, T1140, T1112, T1070.004, T1070.006, T1070.008, T1564.004, T1564.005, T1564.012, T1218.011, T1685, T1620, T1497.003, T1001.001, T1001.002, T1001.003, T1110, T1555.004, T1003.001, T1003.002, T1003.004, T1003.006, T1056.001, T1558.001, T1558.002, T1550.002, T1087.001, T1087.002, T1083, T1615, T1120, T1069.001, T1069.002, T1057, T1012, T1018, T1518.001, T1082, T1016, T1016.001, T1049, T1007, T1124, T1201, T1135, T1033, T1010, T1046, T1680, T1021.002, T1570, T1005, T1025, T1213.006, T1560.001, T1119, T1074.001, T1113, T1125, T1114.001, T1114.002, T1071.001, T1071.002, T1071.003, T1071.004, T1102, T1102.002, T1573.001, T1573.002, T1090, T1090.001, T1090.003, T1095, T1572, T1008, T1104, T1105, T1132.001, T1132.002, T1029, T1030, T1205, T1205.002, T1041, T1567.002, T1048.003, T1020, T1485","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fadversary-emulation\u002Fturla","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill turla-venomous-bear",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill turla-venomous-bear",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill turla-venomous-bear","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fshared\u002Fadversary-emulation\u002Fturla\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]