Turla
aka Secret Blizzard, Venomous Bear, Snake, Uroburos, Waterbug, IRON HUNTER
A veteran espionage group attributed to Russia's FSB. In 2025 it targeted foreign embassies in Moscow by intercepting traffic at the internet provider level.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Attributed to Russia's FSB Center 16 — Microsoft (citing US CISA)
- Describes it as attributed to Russia's FSB — MITRE ATT&CK
How they attack
Entry
Fake portal pages injected on the line
Like rigging the phone exchange so calls reach a fake receptionist instead of the real one.
Inside
Making devices trust a fake ID
Like giving the guard a list that says 'treat this forged ID as genuine'.
Inside
Using doors opened by allied hackers
Like the main burglar climbing through a window a scout left open.
Goal
Long-term spying on diplomats
Like cutting a tiny peephole into an embassy mailbox that goes unnoticed for years.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily