Home › Threat Actors › Secret Blizzard (Turla)
← All Threat Actors
Nation-State critical Russia

Secret Blizzard (Turla)

Russian state-sponsored (FSB — Federal Security Service) · Espionage / intelligence collection / counter-intelligence

Reports 1
Active Since 1996
Last Reported 15 Jun 2026
Sectors Targeted government, defence, diplomatic, critical-infrastructure, communications

Tactics, Techniques & Procedures (TTPs)

  • Kazuar backdoor rebuilt as a P2P botnet — C2 distributed across victim machines rather than centralised servers, making disruption exceptionally difficult
  • ISP-level adversary-in-the-middle (AiTM) against foreign embassies in Moscow — injecting ApolloShadow via legitimate software update channels at the carrier level
  • Storm-0156 infrastructure hijacking — piggybacking on Pakistani APT (Storm-0156) infrastructure to reach Afghan government and Indian Army networks while falsely implicating Pakistani attribution
  • Snake/Uroburos kernel rootkit for deep, reboot-persistent compromise on high-value targets
  • Long-duration stealth: operational continuity since Moonlight Maze (1996-1999) across multiple law enforcement disruptions
  • HTTP/HTTPS-based C2 using legitimate web services to blend with normal enterprise traffic

Known Targets

European and NATO government ministriesForeign embassies in Moscow (via ISP AiTM)Defence ministries and contractorsAfghan government networks (via Storm-0156 pivot)Indian Army networks (via Storm-0156 pivot)Telecommunications and energy operators

Analyst Notes

Secret Blizzard (Turla) is the FSB's premier espionage capability with an operational record stretching back to Moonlight Maze. Operation MEDUSA (FBI, May 2023) disrupted the Snake rootkit infrastructure, but operations evolved and continued. The Storm-0156 hijacking technique — reaching Afghan and Indian Army networks via Pakistani APT infrastructure — provides both operational access and deliberate attribution confusion. This, combined with ISP-level AiTM against diplomatic missions in Moscow, represents some of the most sophisticated sustained offensive operations documented from any nation-state. Kazuar's P2P architecture means no single C2 server can be seized or blocked.

Also Known As

TurlaSnakeUroburosVenomous BearWaterbugKRYPTONG0010 (MITRE)

MITRE ATT&CK Techniques

T1014 Rootkit (Snake/Uroburos) T1557 Adversary-in-the-Middle (ISP-level AiTM) T1199 Trusted Relationship (Storm-0156 infrastructure hijack) T1090 Proxy (P2P Kazuar botnet architecture) T1071.001 Application Layer Protocol: Web Protocols

Intelligence Reports

Analysis governmentdefence

Secret Blizzard: Inside Russia's Most Patient Cyber Espionage Operation

A deep dive into Secret Blizzard (Turla), the FSB-linked APT that has sustained global intelligence collection for over two decades — hijacking criminal infrastructure, deploying ISP-level interception against foreign embassies, and evolving the Kazuar backdoor into a resilient P2P botnet.

15 Jun 2026 · 12 min read