← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Threat Group Assessment: Turla (aka Pensive Ursa)
WHITE Turla AlienVault 2023-09-18 Modified: 2023-10-18
105
IOCs
HIGH VOLUME
A threat assessment of Turla (aka Pensive Ursa) breaks down this Russian-based APT's arsenal and techniques used, covering the top 10 active malware employed.
ComRATKazuarKopiluwakQUIETCANARYAPTTurlaCapibarCrutchPensive UrsaTinyTurla
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Kazuar Crutch - S0538 ComRAT - S0126 QUIETCANARY HyperStack - S0537 Capibar TinyTurla - S0668 Snake KopiLuwak
Indicators of Compromise (12 / 105 total)
All hostname domain FileHash-SHA256 URL FileHash-SHA1
TYPEINDICATORDESCRIPTIONCREATED
URL http://mail.lebsack.de/MICROSOFT.EXCHANGE.MAILBOXREPLICATIONSERVICE.PROXYSERVICE/RPCWITCHERT/SYNC — 2023-09-18
URL http://mail.arlingtonhousing.us/outlook/api/logoff.aspx — 2023-09-18
URL http://octoberoctopus.co.za/wp-includes/sitemaps/web/ — 2023-09-18
URL http://mail.aet.in.ua/outlook/api/logoff.aspx — 2023-09-18
URL http://mail.numina.md/owa/scripts/logon.aspx — 2023-09-18
URL http://www.bombheros.com/wp-content/languages/index.php — 2023-09-18
URL http://mail.kzp.bg/outlook/api/logoff.aspx — 2023-09-18
URL http://www.simplifiedhomesales.com/wp-includes/images/index.php — 2023-09-18
URL http://sansaispa.com/wp-includes/images/gallery/ — 2023-09-18
URL http://www.pierreagencement.fr/wp-content/languages/index.php — 2023-09-18
URL http://mtsoft.hol.es/wp-content/gallery/ — 2023-09-18
URL http://mail.lechateaudelatour.fr/MICROSOFT.EXCHANGE.MAILBOXREPLICATIONSERVICE.PROXYSERVICE/RPCWITCHERT/SYNC — 2023-09-18
References (1)
↗ https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/