CYFIRMA Details Turla’s Espionage Profile and 2026 Campaigns
Summary
CYFIRMA profiles Russia-linked Turla’s long-running espionage and reports suspected STOCKSTAY use against government and defense entities in Ukraine and Italy, plus researchers’ report of a July 2026 intrusion campaign targeting French organizations.
Key points
- The profile describes Turla as a Russia-linked espionage group active since at least 2008, targeting government, diplomatic, military, research, and technology organizations.
- CYFIRMA says Turla activity from April to June 2026 involved strategic environments including email and communications systems, enterprise networks, VPNs, proxies, operating systems, and web applications.
- In July 2026, CYFIRMA reported suspected STOCKSTAY backdoor use against government organizations, Western foreign ministries, and defense entities in Ukraine and Italy.
- Researchers reported a July 2026 Turla intrusion campaign targeting French organizations in diplomatic, defense, justice, and technology sectors.
- The profile lists malware associated with Turla, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.
- The profile characterizes Turla’s approach as prioritizing stealth and long-term access, and maps techniques including spearphishing, process injection, persistence mechanisms, and encrypted command-and-control.
Article Details
- Publisher
- CYFIRMA
- Report Period
- April–July 2026
- Scope
- Turla profile and reported cyber-espionage activity targeting government, diplomatic, defense, research, and technology organizations.
- Key Statistics
- Turla is reported to have been active since at least 2008.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe profile says Turla uses SMB or Windows admin shares for lateral movement.T1055 · Process InjectionThe profile attributes process injection to Turla as an evasion technique.T1059.003 · Windows Command ShellThe profile attributes Windows command-shell execution to Turla.T1068 · Exploitation for Privilege EscalationThe profile says Turla exploits vulnerabilities for privilege escalation.T1071.001 · Web ProtocolsThe profile says Turla uses web protocols for command-and-control traffic.T1078.003 · Local AccountsThe profile says Turla uses valid local accounts to gain or maintain access.T1083 · File and Directory DiscoveryThe profile attributes file and directory searches to Turla.T1090 · ProxyThe profile says Turla routes traffic through proxies to conceal its origin.T1102 · Web ServiceThe profile says Turla uses web services for command and control or hosting.T1105 · Ingress Tool TransferThe profile attributes downloading or transferring tools into victim environments to Turla.T1110 · Brute ForceThe profile attributes password guessing to Turla.T1547.001 · Registry Run Keys / Startup FolderThe profile says Turla maintains persistence through registry run keys or startup folders.T1555.004 · Windows Credential ManagerThe profile says Turla harvests credentials from Windows Credential Manager.T1566.002 · Spearphishing LinkThe profile attributes spearphishing links as an initial-access method.T1567.002 · Exfiltration to Cloud StorageThe profile attributes exfiltration through cloud storage services to Turla.
Threat Actors
Group 88The source lists Group 88 as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.Iron HunterThe source lists Iron Hunter as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.KryptonThe source lists Krypton as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.Secret BlizzardThe source lists Secret Blizzard as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.Sig23The source lists Sig23 as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.SnakeThe source lists Snake as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.SummitThe source lists Summit as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.TurlaThe source describes Turla as a Russia-linked APT group conducting long-term cyber espionage, and reports suspected STOCKSTAY activity and campaigns targeting French organizations.Turla TeamThe source lists Turla Team as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.UAC-0194The source lists UAC-0194 as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.UroburosThe source lists Uroburos as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.Venomous BearThe source lists Venomous Bear as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.WaterbugThe source lists Waterbug as an alternate name for Turla, which it describes as a Russia-linked cyber-espionage group.
Malware
CarbonThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.ComratThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.EpicThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.GazerThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.KazuarThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.LightneuronUroburos, Comrat, Epic, Stockstay Backdoor, Kazuar, Carbon, Wildday, Lightneuron, Apolloshadow, Mosquito, Diamondback, Powerstallion, Gazer, and Tinyturla-NG.STOCKSTAYRecent campaigns in 2026 included STOCKSTAY backdoor activity and attacks on French entities, showing continued focus on stealthy intelligence collection and strategic access.TinyTurla-NGThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.UroburosThe group maintains a broad malware ecosystem, including Uroburos, Comrat, Epic, Kazuar, Carbon, Gazer, and Tinyturla-NG.WILDDAYUroburos, Comrat, Epic, Stockstay Backdoor, Kazuar, Carbon, Wildday, Lightneuron, Apolloshadow, Mosquito, Diamondback, Powerstallion, Gazer, and Tinyturla-NG.
Countries
France#TurlaItalyIn July 2026, CYFIRMA reported suspected STOCKSTAY backdoor use against government organizations, Western foreign ministries, and defence entities in Ukraine and Italy.RussiaTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.UkraineIn July 2026, CYFIRMA reported suspected STOCKSTAY backdoor use against government organizations, Western foreign ministries, and defence entities in Ukraine and Italy.
Industries
Aerospacetoward defense contractors, telecommunications providers, technology companies, research organizations, aerospace entities, and critical infrastructure.Critical infrastructureproviders, technology companies, research organizations, aerospace entities, and critical infrastructure.DefenseThe actor regularly enhances its malware ecosystem by introducing improved persistence mechanisms, defense-evasion techniques, encrypted communications, and modular functionality to maintain operational effectiveness.DiplomaticTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.GovernmentTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.JusticeAlso in July 2026, researchers reported a Turla intrusion campaign against French organizations in diplomatic, defence, justice, and technology sectors.MilitaryTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.ResearchTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.TechnologyTurla is a Russia-linked APT group that has conducted long-term cyber espionage against government, diplomatic, military, research, and technology targets across multiple countries since at least 2008.Telecommunicationsorganizations remain primary targets, Turla has also expanded its focus toward defense contractors, telecommunications providers, technology companies, research organizations, aerospace entities, and critical