Home
cd ../playbooks
Developer ToolsAdvanced

Adversary Emulation: Turla

An intelligence-grounded, authorized purple-team emulation profile for Turla (MITRE ATT&CK G0010), Russia's FSB-linked espionage group — attribution, distinctive TTPs (satellite C2 hijacking, steganographic email backdoors, parasitizing rival APT infrastructure), emulation guidance mapped to generic red-team tooling, and paired detection recommendations, under an explicit authorized-use and lab-only caveat for rootkit techniques.

15 minutes
By PurpleAILAB (Decepticon)Source
#security#adversary-emulation#red-teaming#threat-intelligence#mitre-attack#purple-team

Turla doesn't just compromise targets — it has twice been caught hijacking another nation-state's own C2 infrastructure and deploying implants through that rival's existing victim access, a documented TTP most purple-team exercises never think to test defenders against because almost no generic threat model includes it.

Who it's for: purple-team and red-team operators running authorized adversary emulation exercises, blue-team detection engineers validating coverage against sophisticated state-linked actors, security teams in government, diplomatic, defense, or research sectors Turla has historically targeted, SOC analysts building detections for steganographic C2, passive non-beaconing implants, or Exchange Transport Agent abuse

Example

"Run a purple-team exercise emulating a sophisticated state-linked espionage actor's long-dwell-time tradecraft" → Turla's documented TTPs mapped by ATT&CK tactic (Exchange Transport Agent persistence mirroring LightNeuron, Gmail-based C2 mirroring ComRAT v4, a passive non-beaconing implant activated by a trigger packet), each one paired with the specific detection logic meant to catch it, with kernel-rootkit techniques explicitly scoped to isolated-lab-only use

CLAUDE.md Template

New here? 3-minute setup guide → | Already set up? Copy the template below.

# Adversary Emulation Profile: Turla

An intelligence-grounded adversary-emulation profile for Turla (MITRE ATT&CK G0010 — also tracked as Venomous Bear, Secret Blizzard, Waterbug, KRYPTON, Snake), one of the most sophisticated and long-running cyber-espionage groups in existence, attributed to Russia's FSB Center 16, active since at least 2004.

**Authorized-use caveat:** apply this profile only within the documented rules of engagement, target scope, and time window of an authorized purple-team or red-team engagement. Never deploy kernel rootkits or destructive capabilities outside an explicitly sanctioned, isolated lab environment.

## Profile Summary

Turla has compromised victims in over 50 countries across government, diplomatic, military, defense, education, research, and pharmaceutical sectors. The group is defined by extraordinary technical depth — the Snake/Uroburos kernel rootkit, satellite-based C2 hijacking, steganographic email backdoors, and the audacious practice of hijacking *other* nation-state APTs' infrastructure to operate through it. Its malware ecosystem (Snake, Carbon, ComRAT, Kazuar, LightNeuron, Penquin, TinyTurla, the Lunar toolset) spans Windows, Linux, and macOS with a breadth and longevity essentially unmatched among documented threat actors. The 2023 FBI Operation MEDUSA takedown of the Snake peer-to-peer network — active across 50+ countries for nearly 20 years — illustrated the global scale of the group's operations.

**Sponsor / motivation:** Russian FSB Center 16, attributed with high confidence via U.S. DOJ court filings, joint CISA/NSA/FBI advisories, and consistent named vendor reporting. Turla is a pure espionage actor with no documented financially motivated or destructive campaigns — its sole objective is persistent, covert, long-dwell-time access to high-value targets.

**Sectors and regions:** government and diplomatic bodies (especially foreign ministries and embassies), military and defense, education/research, pharmaceutical, think tanks, and media; primary focus on Europe and Central Asia, with significant activity across the Middle East, South Asia, and NATO member states, documented in 50+ countries.

## What Makes Turla Distinctive

- **Infrastructure hijacking of other APTs.** Turla has compromised and operated through the C2 infrastructure of at least two other nation-state actors — Iranian APT OilRig/APT34 (2019) and Pakistani APT Storm-0156 (2024) — deploying its own implants through their existing victim access. This is a documented, repeated TTP, not a one-off.
- **Satellite C2 hijacking.** Since roughly 2007, Turla hijacked unencrypted DVB-S satellite internet downlinks (primarily from Middle Eastern/African ISPs) to mask C2 server locations, abusing legitimate subscribers' IP addresses as C2 endpoints.
- **Steganographic, email-based C2.** LightNeuron (deployed as a Microsoft Exchange Transport Agent) intercepts and modifies live email traffic, embedding C2 commands in PDF/JPEG attachments. ComRAT v4 uses the Gmail web interface itself as a C2 channel, receiving commands and exfiltrating data as encrypted email attachments.
- **Passive, non-beaconing implants.** The Penquin Linux implant monitors network traffic via BPF socket filters and activates only on a magic packet — producing zero outbound C2 traffic until triggered.

## Representative TTPs by ATT&CK Tactic

- **Resource Development** — accounts on Dropbox, GitHub, Pastebin, and Gmail for C2/exfiltration (T1583.006); hijacked VPS infrastructure from a compromised rival APT (T1584.003); compromised WordPress sites used as C2 relay nodes (T1584.004).
- **Initial Access** — watering-hole attacks (T1189); spearphishing with links to fake download pages (T1566.001/002).
- **Persistence** — Exchange Transport Agent abuse for email-based persistence (T1505.002); Outlook add-in persistence; service masquerading with a minimal fallback backdoor mimicking a legitimate system service name (T1543.003, T1036.004).
- **Defense Evasion** — kernel-mode rootkit with a hidden NTFS virtual filesystem (T1014); Registry-based fileless payload staging (T1027.011); AMSI bypass patching (T1685).
- **Command and Control** — Gmail/webmail-based C2 with encrypted attachments (T1071.003, T1102.002); passive, non-beaconing implants activated by a magic packet (T1205.002); multi-hop peer-to-peer proxy chains through compromised internal hosts (T1090.003); steganographic C2 embedded in PDF/JPEG attachments (T1001.002).
- **Credential Access** — the full domain-takeover chain: LSASS dump → DCSync → golden ticket → pass-the-hash lateral movement (T1003.001, T1003.006, T1558.001, T1550.002).
- **Collection and Exfiltration** — documents staged in RAR archives, exfiltrated via WebDAV to cloud storage (OneDrive, Dropbox), with a deliberately low-and-slow, scheduled cadence (T1567.002, T1029).
- **Lateral Movement** — parasitizing another threat actor's existing C2 infrastructure and victim access (T1584.003, T1584.004).

## Emulation Guidance

Apply these authorized-only within a sanctioned engagement, mapped to whatever C2, phishing, and post-exploitation tooling your team is cleared to use — none of the following requires Turla's actual malware, only equivalent technique coverage:

- **Watering hole + spearphishing** — craft targeted spearphishing with links to convincing fake download pages, or JavaScript-based droppers, mirroring Turla's Mosquito/KOPILUWAK initial-access pattern.
- **Exchange-based persistence** — where Exchange is in scope, deploy a Transport Agent that intercepts email flow, emulating LightNeuron — Turla's most distinctive persistence mechanism. Where agent access is unavailable, an Outlook add-in is a reasonable substitute.
- **Service masquerading fallback** — install a minimal backdoor as a Windows service with a name matching a legitimate system component (mirroring TinyTurla), as a deliberate fallback channel that survives detection of a primary implant — Turla's signature resilience pattern.
- **Kernel rootkit (lab only)** — in an isolated lab only, emulate Uroburos/Snake's kernel-level persistence and hidden virtual filesystem. Outside a lab, limit this technique to fileless Registry-based staging and AMSI-bypass patching.
- **Email/webmail-based C2** — establish a channel mimicking ComRAT v4's Gmail-based communication (commands and responses as email attachments), plus a redundant web-service C2 profile (Dropbox/GitHub).
- **Passive implant** — deploy a non-beaconing implant that monitors traffic and activates only on a specific trigger packet, to test whether defenders can detect an implant with zero routine outbound traffic.
- **Multi-hop C2 relay** — chain compromised internal systems as proxy nodes to reproduce Snake/Uroburos's signature P2P relay architecture.
- **Steganographic C2** — embed C2 commands in PDF/JPEG email attachments to test whether email security controls catch malicious content hidden in otherwise-legitimate-looking files.
- **Domain-takeover credential chain** — drive the full LSASS-dump → DCSync → golden-ticket → pass-the-hash sequence to mirror Turla's documented pattern for establishing persistent domain-level access.
- **Infrastructure hijacking (multi-team only)** — where a multi-team engagement design allows it, emulate accessing a simulated rival actor's C2 infrastructure to deploy through their existing access, testing whether defenders can distinguish between distinct actors sharing infrastructure.

## Detection and Defense Guidance

- **Kernel rootkit / Snake** — Secure Boot with UEFI firmware integrity monitoring; kernel-mode code integrity (KMCI/HVCI); alert on unsigned kernel drivers and anomalous raw disk/filesystem access; hunt for hidden NTFS streams. CISA advisory AA23-129A provides Snake-specific detection signatures and YARA rules.
- **Exchange Transport Agent abuse** — audit installed agents (`Get-TransportAgent`); monitor for new/modified DLLs in transport directories; inspect attachments for steganographic anomalies (oversized image/PDF metadata).
- **Email/Gmail-based C2** — monitor for unusual browser automation against webmail; detect authenticated Gmail/Outlook web requests outside normal user sessions; alert on suspicious double-extension attachment patterns (`.jpg.bfe`).
- **PowerShell abuse + AMSI bypass** — enable Script Block and Module logging; monitor for `amsi.dll` patch attempts; alert on PowerShell profile modifications outside normal admin processes.
- **Passive implants** — since they produce no routine outbound traffic, focus on the activation event: an unusual single-packet inbound connection followed by an outbound data transfer.
- **Credential dumping** — LSA protection (`RunAsPPL`) and Credential Guard; alert on LSASS handle access with `PROCESS_VM_READ`; monitor DCSync requests from non-domain-controller hosts; detect Kerberos ticket anomalies (golden/silver ticket indicators).
- **Watering-hole delivery** — monitor partner/upstream sites for exploit-kit indicators; browser isolation for high-risk browsing; hunt for iframe/redirect injections on relevant organizational websites.
- **APT infrastructure hijacking** — during multi-actor incident response, correlate C2 infrastructure across distinct clusters and watch for an unexplained secondary implant deployed through another actor's already-attributed C2.
- **Cloud exfiltration** — monitor for bulk uploads to consumer cloud storage from unusual processes or outside business hours; DLP on encrypted archive uploads; alert on WebDAV PUT/PROPFIND to external endpoints.
- **Service-based fallback persistence** — audit services for DLLs mimicking legitimate system components; compare service DLL hashes against known-good baselines.

## Sources

MITRE ATT&CK G0010; CISA Advisory AA23-129A (Snake malware); DOJ Operation MEDUSA court filings; NSA/NCSC 2019 joint advisory on Turla's OilRig infrastructure hijacking; Microsoft's 2024 reporting on the Storm-0156 infrastructure compromise; and public threat-intelligence reporting from ESET, Kaspersky, Symantec/Broadcom, Unit 42, Mandiant, and Cisco Talos.

Get new playbooks like this one

One email a week with new Claude Code workflows. Free, like everything here.

No spam. Unsubscribe anytime.

README.md

What This Does

A structured, citation-backed adversary-emulation profile for Turla (MITRE ATT&CK G0010, also tracked as Venomous Bear, Secret Blizzard, and Waterbug), a Russian FSB Center 16-attributed espionage group active since at least 2004 with one of the broadest and longest-running malware ecosystems of any documented threat actor. Beyond standard attribution and targeting, it foregrounds what actually makes Turla worth emulating specifically: a documented, repeated pattern of hijacking other nation-states' own C2 infrastructure (Iranian APT OilRig in 2019, Pakistani APT Storm-0156 in 2024) and deploying implants through their existing victim access — a TTP almost no generic red-team scenario tests defenders against — alongside satellite-downlink C2 hijacking, an Exchange Transport Agent backdoor (LightNeuron) that intercepts live email with steganographic commands, and a passive Linux implant (Penquin) that produces zero outbound traffic until triggered by a magic packet.

Every offensive technique carries a generalized emulation instruction (mapped to whatever C2, phishing, and post-exploitation tooling your team is actually cleared to use, never requiring Turla's specific malware) paired with concrete detection guidance — Exchange Transport Agent auditing for the LightNeuron pattern, activation-packet-focused monitoring for the passive implant, UEFI/kernel-integrity monitoring for the Snake rootkit. The authorized-use caveat is explicit and technique-specific: kernel rootkit emulation is scoped to an isolated lab environment only, with fileless Registry staging and AMSI-bypass patching offered as the non-lab-safe alternative for testing similar evasion coverage.


Quick Start

Step 1: Create a Project Folder

mkdir adversary-emulation-turla && cd adversary-emulation-turla

Step 2: Download the Template

Click Download above, then:

mv ~/Downloads/CLAUDE.md ./

Step 3: Run an Authorized Exercise

claude

Within an authorized purple-team engagement, ask Claude to plan an exercise emulating Turla's tradecraft, or to build detection logic for a specific technique — the Exchange persistence pattern, the passive implant model, or the email-based C2. It will map the documented TTPs to your actual authorized tooling and pair every offensive step with matching detection guidance.


Tips & Best Practices

  • Confirm rules of engagement before touching anything rootkit-related — the caveat here is explicit and non-negotiable: kernel-level persistence techniques run in an isolated lab only, never in a live authorized-engagement environment, regardless of how tightly scoped the rest of the exercise is.
  • Prioritize testing the passive-implant and Exchange Transport Agent patterns specifically — both represent detection blind spots most environments haven't built coverage for, since standard EDR heuristics assume regular outbound beaconing and standard mail-flow monitoring rarely audits installed Transport Agents.
  • If your organization runs a multi-team or coalition exercise, the infrastructure-hijacking technique is worth the extra design effort — it's one of the few TTPs that specifically tests whether analysts can distinguish between distinct threat actors operating through the same compromised infrastructure.

Limitations

  • Intelligence-grounded but still a synthesis of public reporting — treat it as a strong starting profile for an exercise, not a guarantee of complete coverage of the actor's full, non-public capability.
  • Several signature techniques (the Snake kernel rootkit, satellite C2 hijacking, infrastructure parasitism) require either an isolated lab or a multi-team exercise design to emulate safely and meaningfully — a standard single-team engagement will only be able to cover a subset of the full profile.
  • Emulation guidance intentionally stays tool-agnostic rather than naming a specific commercial or open-source platform — teams will need to translate each technique into their own cleared toolset.

$Related Playbooks

Developer Tools

AI Agent Red Team Methodology

A first-principles methodology for authorized red-team exercises against AI products, agents, MCP servers, skills, and repositories — capability and trust-boundary modeling, AI-specific attack hypothesis families (prompt injection, tool misuse, data leakage, SSRF), harmless-proof testing with canaries, one-variable-at-a-time adaptive iteration, and business-language evidence-based reporting.

10 minutes
Advanced
Developer Tools

Agent DX CLI Scale

A 7-axis, 0-21 scoring scale for evaluating how well a CLI is designed for AI agents rather than humans — machine-readable output, raw payload input, schema introspection, context-window discipline, input hardening, safety rails, and agent knowledge packaging.

5 minutes
Intermediate
Developer Tools

Agent Design Philosophy

A mental model for designing AI agents in any domain — the model already knows how to be an agent, so design is about capabilities, knowledge, and context, added only as far as a Progressive Complexity ladder (basic → planning → subagents → skills) that real usage actually demands.

10 minutes
Intermediate
Developer Tools

Agent Prompt Architect

A compact seven-field skeleton (Role, Goal, Inputs, Constraints, Process, Output, Verification, Fallback) and a fast refinement loop for turning vague intent into a prompt an agent can execute reliably every time.

5 minutes
Beginner
Developer Tools

CEO-Mode Plan Review

Review a technical or product plan the way a great CEO would — pick a mode (expand scope, cherry-pick expansions, hold scope, or cut ruthlessly), then apply nine prime directives and eleven cognitive patterns to catch every silent failure, missing edge case, and unnamed error before it ships.

10 minutes
Advanced
Developer Tools

Agent SDK App Builder

Scaffold new Claude Agent SDK applications in TypeScript or Python, and verify existing ones against official SDK patterns before you ship.

10 minutes
Intermediate
Developer Tools

Brandkit Generator: Premium Identity Board Creator

An image-direction rule set that produces a complete brand-guidelines board in one image: logo concept, color system, typography, and applications, grounded in brand strategy instead of random logo generation

5 minutes
Beginner
Developer Tools

Brutalist UI Skill: Industrial & Tactical Interface Design

A design language that forces Claude to build raw, mechanical interfaces — Swiss industrial print or CRT terminal telemetry, with rigid grids and zero rounded corners

5 minutes
Intermediate
Developer Tools

Programmatic Screen Capture

Capture screenshots programmatically on macOS — find window IDs, control application windows via AppleScript, and capture specific windows for documentation and visual workflows.

10 minutes
Intermediate
Developer Tools

AI Agent Builder

Build AI agents with tools, memory, and multi-step reasoning - ChatGPT, Claude, Gemini integration patterns

10 minutes
Advanced
Developer Tools

Browser Automation Assistant

Automate web browser interactions, scraping, testing, and workflow automation with Puppeteer/Playwright

10 minutes
Advanced
Developer Tools

Android Restore Credentials

Implement Android's Restore Credentials feature with androidx.credentials — the two-tier background/foreground restoration architecture, the createCredential fallback for devices without end-to-end encryption, sign-in and deletion flows with real Kotlin code, and the backend guidelines a client-side implementation must hand off to the developer, not implement itself.

10 minutes
Intermediate

Browse all Developer Tools playbooks →