AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Turla
Aliases: BELUGASTURGEON, Group 88, IRON HUNTER, Krypton, Secret Blizzard, Snake, Turla, Venomous Bear, Waterbug, WhiteBear
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Open interactive actor investigation
ATT&CK techniques
T1005T1007T1012T1016T1016.001T1018T1021.002T1025T1027.005T1027.010T1027.011T1036.005T1049T1055T1055.001T1057T1059.001T1059.003T1059.005T1059.006T1059.007T1068T1069.001T1069.002T1071.001T1071.003T1078.003T1082T1083T1087.001T1087.002T1090T1090.001T1102T1102.002T1105T1106T1110T1112T1120T1124T1134.002T1140T1189T1201T1204.001T1213.006T1518.001T1546.003T1546.013T1547.001T1547.004T1553.006T1555.004T1560.001T1564.012T1566.002T1567.002T1570T1583.006T1584.003T1584.004T1584.006T1587.001T1588.001T1588.002T1615T1685
Correlated CTI and IR reports
1. Executive Summary
Israel Threat Actors CTI · explicit report mentionCyber Threat Intelligence Dossier: Iranian and Hamas-Aligned Operations Targeting Israeli and Allied Ecosystems (2023-2026)
Israel Threat Actors CTI · explicit report mentionIOC Tables — MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mention
Israel Threat Actors CTI · explicit report mentionCyber Threat Intelligence Dossier: Iranian and Hamas-Aligned Operations Targeting Israeli and Allied Ecosystems (2023-2026)
Israel Threat Actors CTI · explicit report mentionIOC Tables — MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mention
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Reg tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Systeminfo tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Arp tool reference — Explicit actor uses software relationship in pinned ATT&CK
- nbtstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- certutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- IronNetInjector tool reference — Explicit actor uses software relationship in pinned ATT&CK
- NBTscan tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1007 System Service Discovery simulation — Exact active technique ID
- T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016.001 Internet Connection Discovery simulation — Exact active technique ID
- T1016.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1025 Data from Removable Media simulation — Exact active technique ID
- T1025 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.005 Indicator Removal from Tools simulation — Exact active technique ID
- T1027.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.010 Command Obfuscation simulation — Exact active technique ID
- T1027.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.011 Fileless Storage simulation — Exact active technique ID
- T1027.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.001 Dynamic-link Library Injection simulation — Exact active technique ID
- T1055.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.001 Local Groups simulation — Exact active technique ID
- T1069.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.002 Domain Groups simulation — Exact active technique ID
- T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.003 Mail Protocols simulation — Exact active technique ID
- T1071.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.001 Local Account simulation — Exact active technique ID
- T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.001 Internal Proxy simulation — Exact active technique ID
- T1090.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102 Web Service simulation — Exact active technique ID
- T1102 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.002 Bidirectional Communication simulation — Exact active technique ID
- T1102.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1112 Modify Registry simulation — Exact active technique ID
- T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1120 Peripheral Device Discovery simulation — Exact active technique ID
- T1120 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1134.002 Create Process with Token simulation — Exact active technique ID
- T1134.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1201 Password Policy Discovery simulation — Exact active technique ID
- T1201 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.006 Databases simulation — Exact active technique ID
- T1213.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.003 Windows Management Instrumentation Event Subscription simulation — Exact active technique ID
- T1546.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.013 PowerShell Profile simulation — Exact active technique ID
- T1546.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.004 Winlogon Helper DLL simulation — Exact active technique ID
- T1547.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.006 Code Signing Policy Modification simulation — Exact active technique ID
- T1553.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.004 Windows Credential Manager simulation — Exact active technique ID
- T1555.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.012 File/Path Exclusions simulation — Exact active technique ID
- T1564.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
- T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.003 Virtual Private Server simulation — Exact active technique ID
- T1584.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.004 Server simulation — Exact active technique ID
- T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.006 Web Services simulation — Exact active technique ID
- T1584.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1615 Group Policy Discovery simulation — Exact active technique ID
- T1615 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-name
Blue Team & Defensive Security · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-name