TinyTurla

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

TinyTurla is a backdoor that the Turla threat actor has used against targets in the US, Germany, and Afghanistan since at least 2020.

Stats

First seen: April 2023
Last seen: October 2026

Also known as

Tinyturla

MITRE ATT&CK techniques

14 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1569System Services
- T1569.002Service Execution

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.011Fileless Storage
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.004Masquerade Task or Service

TA0007 Discovery

T1012Query Registry

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1029Scheduled Transfer

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0010Turla

Alert name variants

Alert Name	Engine
Shortcut.Trojan.Tinyturla	ATP Sandbox Adv. Heuristics
Trojan.Agent.TinyTurla.A	AV
Win64.Backdoor.Tinyturla	ATP Sandbox Adv. Heuristics
Win64.Backdoor.TinyTurla	ATP Sandbox Adv. Heuristics
Win64.Trojan.TinyTurla	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.TinyTurla variant outbound connection	IPS-SWG

Related families

InvisiMole Uroburos Bazar Cobalt Strike REvil

References