Satellite Turla - Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:35:34 UTC
Home > List all groups > List all tools > List all groups using tool Satellite Turla
 Tool: Satellite Turla
Names Satellite Turla
Category Malware
Type Backdoor, Tunneling
Description
(Kaspersky) The regular usage of satellite-based Internet links by the Turla group
represents an interesting aspect of their operation. The links are generally up for several
months, but never for too long. It is unknown if this is due to operational security
limitations self-imposed by the group or because of shutdown by other parties due to
malicious behavior.
The technical method used to implement these Internet circuits relies on hijacking
downstream bandwidth from various ISPs and packet-spoofing. This is a method that is
technically easy to implement, and provides a much higher degree of anonymity than
possibly any other conventional method such as renting a VPS or hacking a legitimate
server.
Information Malpedia AlienVault OTX Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool Satellite Turla
Changed Name Country Observed
APT groups
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=007e9044-248a-4e7c-a121-c3b813ffe703
Page 1 of 2

Turla, Waterbug, Venomous Bear 1996-2024  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=007e9044-248a-4e7c-a121-c3b813ffe703
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=007e9044-248a-4e7c-a121-c3b813ffe703
Page 2 of 2