Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Group Assessment: Turla (aka Pensive Ursa)

Summary: Turla, also known as Pensive Ursa, Uroburos and Snake, is a Russian-based threat group linked to the FSB and operating since at least 2004, and it was chosen as the main focus of the 2023 MITRE ATT&CK evaluation. Unit 42 details ten of its most recently active malware families, including Capibar, Kazuar, Snake, Kopiluwak, QUIETCANARY, Crutch, ComRAT, Carbon, HyperStack and TinyTurla, and notes the group has targeted victims in over 45 countries across government, embassies, military, education, research and pharmaceutical sectors.

Why it matters: This is an adversary with malware in active development since 2003, a toolset spanning Windows, macOS and Linux, and a documented role in espionage against Ukraine's defense sector after February 2022 - a 20-year, state-linked operation that MITRE says has global impact.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026