Turla G0010
Also known as IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton.
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.
Documented targeting: Healthcare, Government, Defense, Education & Research
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
TurboPentest can autonomously exercise 1 of 68 of this actor's documented techniques today (1%). 18 are out of scope for automated testing (social engineering, denial of service, physical).
+43 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Known software
Mimikatz, Uroburos, PsExec, Net, Tasklist, Reg, Epic, Systeminfo, Arp, nbtstat, netstat, ComRAT, certutil, Gazer, Mosquito, Kazuar, Carbon, Empire, PowerStallion, LightNeuron.
Emulate Turla. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Who is Turla (G0010)?
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.
What sectors does Turla target?
Based on MITRE ATT&CK, Turla has been observed targeting Healthcare, Government, Defense, Education & Research.
Can TurboPentest test for Turla?
TurboPentest can autonomously exercise 1 of 68 of this actor's documented techniques today. 43 more need internal or assumed-breach access (the Adversarial-Depth tier), and the rest are out of scope for automated testing.
What does it cost to emulate Turla?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.