Turla

Turla is a Russia-linked, state-sponsored cyber-espionage threat actor widely tracked as Secret Blizzard, Venomous Bear, Snake, Waterbug, Uroburos/Ourobouros, Krypton, Summit, and UAC-0194. Multiple cited sources link Turla to Russia’s Federal Security Service (FSB), and the group is described as one of Russia’s longest-running espionage actors, active since at least 2004. The reporting in the provided content focuses on Turla’s use of the .NET backdoor STOCKSTAY, which Google Threat Intelligence Group assessed has been under development since at least December 2022. STOCKSTAY has been used in espionage operations against government and military organizations in Ukraine and against entities with an interest in Italian foreign policy; early related activity was also observed in Italy, the Netherlands, Poland, and Germany. The malware is a modular Windows Forms-based backdoor using secure WebSocket command-and-control, WM_COPYDATA-based IPC, and components for downloading payloads, tunneling traffic, orchestration, persistence, reconnaissance, file operations, registry manipulation, screen capture, and command execution. Researchers reported significant code and architectural overlap between STOCKSTAY and Turla’s KAZUAR framework, and assessed that STOCKSTAY may be developed in parallel with KAZUAR as a redundant or complementary espionage capability. Observed Turla delivery and intrusion methods in the content include phishing emails with malicious RDP configuration files, MSI installers, HTA-based chains, and RAR archives exploiting CVE-2025-8088. Lures repeatedly used academic, diplomatic, and military themes, including abuse of a compromised Ukrainian university account and a diplomatic education platform. Turla also used compromised in-country Ukrainian infrastructure, GitHub-hosted components, compromised WordPress sites, and third-party hosting platforms such as Render and Glitch to stage payloads and obscure infrastructure. The content also notes Turla’s use of Mshta to launch scripts via HTML Applications, its historical association with the Snake implant, and reporting that it used Amadey infections to deploy custom malware against targets in Ukraine. In early 2025, ESET observed collaboration between Gamaredon and Turla, with Gamaredon providing initial access through its loaders for deployment of Turla’s KAZUAR framework. Separate reporting cited in the content also states that Turla previously compromised or used OilRig infrastructure in operations. Overall, the provided material characterizes Turla as an active Russian espionage actor focused on government, military, diplomatic, and related high-value targets, especially in Ukraine, using modular malware, phishing-based initial access, stealthy infrastructure practices, and overlapping toolsets including STOCKSTAY and KAZUAR.