Turla (malware)

Short description: Malware package

This article may lack focus or may be about more than one topic. Please help improve this article, possibly by splitting the article and/or by introducing a disambiguation page, or discuss this issue on the talk page. (June 2017)

|

Turla or Uroboros (Russian: Турла) is a Trojan package that is suspected by computer security researchers and Western intelligence officers to be the product of a Russian government agency of the same name.[1][2][3]

High infection rates of the virus were observed in Russia, Kazakhstan and Vietnam, followed by US and China, and low infection rates in Europe, South America and Asia (including India).[4]

## Contents

* 1 Malware
* 2 Group
* 2.1 US actions against group
* 3 See also
* 4 References

## Malware

Turla has been targeting governments and militaries since at least 2008.[2][5][6]

In December 2014 there was evidence of it targeting operating systems running Linux.[7]

## Group

The advanced persistent threat hacking group has also been named Turla.[1] The group has probably been operating since the late 1990s, according to professor Thomas Rid of Johns Hopkins University.[8] Dan Goodin in Ars Technica described Turla as "Russian spies".[9] Turla has since been given other names such as Snake, Krypton, and Venomous Bear.

### US actions against group

In May 2023 the United States Department of Justice announced that the United States had managed to infiltrate machines that were infected by the malware and issue a command ordering the malware to delete itself.[8] Affidavits from the FBI and DOJ revealed that the group was part of the Russian Federal Security Service Center 16 group in Ryazan.[8]

## See also

* Agent.BTZ
* Red October (malware)

## References

1. ↑ 1.0 1.1 "The Russian Britney Spears Instagram hackers also used satellites to hide their tracks". 8 June 2017. https://boingboing.net/2017/06/08/dvb-s.html.
2. ↑ 2.0 2.1 "Suspected Russian spyware Turla targets Europe, United States". Reuters. 2014-03-13. https://www.reuters.com/article/us-russia-cyberespionage-insight-idUSBREA260YI20140307.
3. ↑ "Archived copy". https://www.valisluureamet.ee/pdf/raport-2018-ENG-web.pdf.
4. ↑ "Turla Hiding in the Sky: Russian Speaking Cyberespionage Group Exploits Satellites to Reach the Ultimate Level of Anonymity" (in en). 26 May 2021. https://www.kaspersky.com/about/press-releases/2015_turla-hiding-in-the-sky-russian-speaking-cyberespionage-group-exploits-satellites-to-reach-the-ultimate-level-of-anonymity.
5. ↑ Brewster, Tom (7 August 2014). "Sophisticated 'Turla' hackers spying on European governments, say researchers". The Guardian. https://www.theguardian.com/technology/2014/aug/07/turla-hackers-spying-governments-researcher-kaspersky-symantec.
6. ↑ "Turla: Spying tool targets governments and diplomats". http://www.symantec.com/connect/blogs/turla-spying-tool-targets-governments-and-diplomats.
7. ↑ Baumgartner, Kurt. "The 'Penquin' Turla". securelist.com. https://securelist.com/the-penquin-turla-2/67962/.
8. ↑ 8.0 8.1 8.2 Greenberg, Andy (2023-05-20). "The Underground History of Russia’s Most Ingenious Hacker Group". Wired. https://www.wired.com/story/turla-history-russia-fsb-hackers/.
9. ↑ "You'll never guess where Russian spies are hiding their control servers". 6 June 2017. https://arstechnica.com/security/2017/06/russian-hackers-turn-to-britney-spears-for-help-concealing-espionage-malware/.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Turla (malware). Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Turla_(malware)&oldid=298472"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template