Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionage
RussiaThreat Actor
Active Threat
Turla
5.6k
IOCs Tracked
499
Intel Reports
Associated IOCs50 total
IP36
91.202.233.214221.207.101.17567.219.102.24446.151.182.205109.73.193.2425.101.86.98162.248.225.1655.101.86.10515.204.95.228178.16.54.24888.119.167.14384.21.189.225107.175.148.68158.247.194.144139.159.203.44163.181.208.79195.123.240.236137.184.163.2718.118.196.244146.70.41.17438.181.42.1608.152.2.8635.220.177.23249.233.81.84202.61.130.170185.186.143.11138.242.212.58.138.222.215219.142.15.101194.233.80.9637.72.172.11045.154.12.150206.210.123.10423.227.198.24647.109.198.894.74.164.177Domain14
dlink.sh2026-08-20High
check.sh2026-08-20High
i-5.8-6.sakura2026-08-20High
a-r.m-4.sakura2026-08-20High
bins.sh2026-08-20High
x-8.6-.sakura2026-08-20High
m-6.8-k.sakura2026-08-20High
w.sh2026-08-20High
test.sh2026-08-20High
script.sh2026-08-20High
dl.sh2026-08-20High
ohshit.sh2026-08-20High
a-r.m-7.sakura2026-08-20High
payload.sh2026-08-20High
Related Reports499 total
OpenPhish (300 entries)
OpenPhish
Abuse.ch ThreatFox (6411 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5582 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5624 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5627 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5627 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5625 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5628 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5630 indicators)
Abuse.ch ThreatFoxJul 31, 2026
Abuse.ch ThreatFox (5633 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5852 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5854 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5862 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5811 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5809 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5837 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5900 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5896 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5913 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5912 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5919 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5921 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5790 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5780 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5606 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5611 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5069 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5098 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5099 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Abuse.ch ThreatFox (5100 indicators)
Abuse.ch ThreatFoxJul 30, 2026
Threat Profile
Motivationespionage
Origin
Russia
Last seenAug 2026
IOCs tracked5,580