Turla
Nation-state Espionage Russia Active
Aliases: Snake · Venomous Bear · Secret Blizzard · Waterbug · Uroburos
- Mentions
- 5
- First seen
- 26 Jun 2026
- Last seen
- 10 Nov 2026
Relevant to you · Relevant
- Threat focus:
- espionage / apt
- Sector / region:
- ManufacturingDACH
Origin
Russia — Russian FSB (Center 16)
Profile
Turla is a Russian cyber espionage group. Recent reports show attacks on government institutions, especially Exchange servers, using new malware such as Cereal and STOCKSTAY. Affected countries include Kazakhstan, Romania and Ukraine. The EU has imposed sanctions on Russia over Turla activities.
Affected vendors
Microsoft
Targeted sectors
Government
Targeted regions
EuropeCentral Asia
Targeted countries
UkraineKazakhstanRomania
Associated malware / tools
STOCKSTAYCereal
Activity (8 weeks)
Recent activity
- Turla hackers use new Cereal malware to spy on govt Exchange servers BleepingComputer
- Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments CyberScoop
- Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ CyberScoop
- Schwere Cyberangriffe und Sabotage: EU sanktioniert Russland heise security News
- Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks The Hacker News