RussiaAttributedFSB Center 16EspionageActive 2004 – 2026Turla
Also known asSecret Blizzard · Snake · Uroburos · Venomous Bear · Turla Group · Group 88 · Waterbug · Turla Team · Krypton · SIG23 · MAKERSMARK · ITG12 · SUMMIT · SIG2 · SIG15 · Iron Hunter · CTG-8875 · Pacifier APT · ATK 13 · Belugasturgeon · Popeye · Wraith · TAG-0530 · UNC4210 · Pensive Ursa · Blue Python · WhiteBear · Pfinet · Hippo Team · UAC-0144 · UAC-0024 · UAC-0003 · UAC-0194
Summary
FSB Center 16 espionage actor (Microsoft: Secret Blizzard; also Snake, Venomous Bear, Waterbug, UAC-0194), with the most sophisticated tradecraft in the Russian ecosystem. Newest reporting: GTIG's STOCKSTAY .NET backdoor (high-confidence Turla links), used against Ukrainian military and government targets through 2025 — malicious RDP files, a 'military calculator' HTA lure and a drone-themed WinRAR CVE-2025-8088 wave (Nov 2025); Microsoft's May 2026 analysis of Kazuar as a modular peer-to-peer botnet (Kernel/Bridge/Worker roles, leader election over Mailslot, HTTP/WebSocket/EWS C2). 2025: Kazuar deployed through Gamaredon access on high-value Ukrainian machines (ESET, Feb–Jun) and ApolloShadow ISP-level AiTM against embassies in Moscow (Microsoft). 2022–2024: hijacked Pakistani Storm-0156 C2 servers to reach Afghan and Indian targets (Microsoft, Lumen). LunarWeb/LunarMail against a European MFA's Middle East missions is Turla at ESET's medium confidence. May 2023: FBI Operation MEDUSA disrupted the Snake network, in use since about 2003 across 50+ countries.
Attribution
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Department of Justice (Government, 2023-05-09)
Snake network disruption: "Turla" is a unit within FSB Center 16 - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to Russia's Federal Security Service (FSB)
Campaigns 6
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Rezzuar reconnaissance through Gamaredon access before Kazuar deployment | 2026-03 – 2026-06 | Ukraine | Government, Defense | ESET Research (2026-10-28) — cases from March, April and June 2026 |
| STOCKSTAY backdoor — RDP-file, HTA and drone-themed WinRAR (CVE-2025-8088) phishing against Ukrainian military and government | 2025-03 – 2025-11 | Ukraine, Italy | Military, Government, Education | Google Threat Intelligence Group (2026-06-25) |
| Kazuar via Gamaredon access — high-profile Ukrainian targets | 2025-02 – 2025-06 | Ukraine | Government, Defense | ESET Research (2025-09-19) |
| ApolloShadow — ISP-level AiTM against foreign embassies in Moscow | 2024 – ongoing | Russia (foreign embassies) | Diplomatic | Microsoft Threat Intelligence (2025-07-31) |
| Hijacking Storm-0156 (Pakistan) C2 infrastructure for Afghan and Indian targets | 2022-11 – 2024-08 | Afghanistan, India, Pakistan | Government, Military | Microsoft Threat Intelligence (2024-12-04); Lumen Black Lotus Labs |
| European MFA Targeting (LunarWeb/LunarMail)ASSESSED | 2020 – 2023 | EU, Middle East | Diplomatic, Government | ESET Research (2024-05-15) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 12
| Resource Development1 | T1584Compromise Infrastructure |
|---|---|
| Initial Access1 | T1566.001Spearphishing Attachment |
| Execution1 | T1203Exploitation for Client Execution |
| Persistence2 | T1547Boot or Logon Autostart ExecutionT1547.003Time Providers |
| Stealth1 | T1055Process Injection |
| Defense Impairment1 | T1553.004Install Root Certificate |
| Credential Access2 | T1003OS Credential DumpingT1557Adversary-in-the-Middle |
| Command and Control3 | T1573Encrypted ChannelT1102Web ServiceT1071.004DNS |
Malware and tools 12
| Name | Description | Platform |
|---|---|---|
| Snake/Uroburos | Kernel Rootkit | Windows |
| Carbon | Modular Backdoor | Windows |
| TinyTurla | Lightweight Backdoor | Windows |
| ComRAT v4 | File-system RAT | Windows |
| Kazuar v3 | Backdoor (.NET) | Windows |
| LunarWeb | Backdoor | Windows |
| LunarMail | Outlook Backdoor | Windows |
| TinyTurla-NG | Backdoor | Windows |
| ApolloShadow | Root-certificate installer / backdoor | Windows |
| Kazuar | Modular P2P botnet backdoor (.NET; Kernel/Bridge/Worker modules) | Windows |
| STOCKSTAY | .NET backdoor (STOCKMARKET orchestrator, STOCKBROKER WebSocket tunneler, STOCKTRADER) | Windows |
| Rezzuar | Reconnaissance script (VBScript) | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-8088 | 8.4 | RARLAB WinRAR — path traversal via alternate data streams (KEV 2025-08-12) |
Highest CVSS first.
Infrastructure patterns
- Reuses other actors' footholds — Storm-0156 C2 servers (2022–2024) and Gamaredon-infected machines (2025)
- Kazuar P2P botnet: one elected leader talks to C2 over HTTP, WebSockets or EWS (Microsoft, 2026)
Reporting and advisories 10
- CISA
AA23-129A — Hunting Snake Malware (Five Eyes) - DoJ
Operation MEDUSA — Snake malware disruption - Microsoft Threat Intelligence
Hijacking Storm-0156 (Pakistan) C2 infrastructure for Afghan and Indian targets - ESET Research
European MFA Targeting (LunarWeb/LunarMail) - Microsoft Threat Intelligence
ApolloShadow — ISP-level AiTM against foreign embassies in Moscow - ESET Research
Kazuar via Gamaredon access — high-profile Ukrainian targets - Google Threat Intelligence Group
STOCKSTAY backdoor — RDP-file, HTA and drone-themed WinRAR (CVE-2025-8088) phishing against Ukrainian military and government - MITRE ATT&CK
Turla (G0010) group profile - Microsoft Threat Intelligence
Kazuar: anatomy of a nation-state botnet (May 2026) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)