Turla
Turla is a threat actor group with an ideological motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 46 countries, including the United States and the United Kingdom. It uses 42 MITRE ATT&CK techniques and exploits 2 known CVEs.
- Techniques
- 42
- Exploited CVEs
- 2
- Last seen
- Jan 1, 2020
- Record updated
Who They Target.
About Turla.
Turla, also known by a multitude of aliases including Venomous Bear, Waterbug, and Snake, is a highly sophisticated, Russian-based advanced persistent threat (APT) group attributed to Center 16 of Russia's Federal Security Service (FSB). With a history of operations dating back to at least 1996, including links to the historic Moonlight Maze campaign, Turla has established itself as one of the most enduring and stealthy cyberespionage actors. The group is known for its longevity, adaptability, and its ability to remain undetected within victim networks for extended periods. The primary motivation for Turla is long-term cyberespionage in service of Russian geopolitical, military, and diplomatic objectives. The group does not appear to be financially motivated, instead focusing on maintaining indefinite access to high-value targets to gather sensitive intelligence. Its operations have impacted over 50 countries, with a primary focus on Europe, NATO members, North America, the Middle East, and Central Asia.
Last updated Oct 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.