Epic Turla

  • First known sample

    2012
  • Discovery

    2014
  • Number of targets

    100-1000
  • Current status

    Active
  • Type

    Backdoor
  • Targeted platforms

    Windows
  • TOP targeted countries

    Belarus , France , Iran , Kazakhstan , Netherlands , Poland , Romania , Russia , Saudi Arabia , Ukraine
  • Connected attacks

  • The way of propagation

    Exploits , Social engineering , Watering hole attacks
  • Purpose/Functions

    Cyberespionage , Data wiping
  • Special features
    Epic Turla is able to upgrade itself to Turla\Uroboros malware
  • Targets

    Academia/Research , Diplomatic organizations/embassies , Government entities , Intelligence agencies , Military , Pharmaceutical
  • Artefacts/Attribution
    Language artifacts in the malware code of malware suggest Russian speaking authors
  • Description

    A massive cyber-espionage operation utilizing two zero-day exploits to infect several hundred computers in more than 45 countries, including government institutions, embassies, research and pharmaceutical companies, and military and educational organizations. The malware is distributed via spear-phishing emails, social engineering tricks, and watering hole attacks with targets primarily from Europe and the Middle East.

    Additional information