Turla Group

The Turla group, also known as Pensive Ursa, Krypton, Secret Blizzard, Venomous Bear, or Uroburos, is a notable threat actor that has been linked to the Russian Federal Security Service (FSB). With a history dating back to 2004, this group operates in painstaking stages, first conducting reconnaissance on their victims' systems before deploying their more sophisticated tools. One such tool is Carbon, a second-stage backdoor used to steal sensitive information from targets of interest. This backdoor may be a "lite" version of Uroburos, and its deployment typically follows an initial stage of system reconnaissance using tools like Tavdig or Skipper. Recently, several new versions of Carbon have been discovered. ESET researchers have analyzed new Tactics, Techniques, and Procedures (TTPs) attributed to the Turla group, which now leverage PowerShell to run malware solely in-memory. Furthermore, similarities have been found between Carbon and another malware strain called Kazuar, further solidifying the attribution of these activities to the Turla group. In response to these threats, the FBI launched Operation Medusa, which resulted in the self-destruction of Turla group's malware. The Turla group has been operational for nearly two decades, even targeting personal computers of journalists reporting on the Russian government. Despite its longevity, the group was eventually taken down, highlighting the persistence required in combatting such long-standing cyber threats.