Turla__2015__waterbug-attack-group.pdf

Symantec's Waterbug report details a state-sponsored threat group that uses Trojan.Wipbot and Trojan.Turla to conduct cyber-espionage via spear-phishing and watering-hole campaigns, exploiting zero-day vulnerabilities and stolen certificates, supported by a Venom distribution network and multi-variant Turla framework to exfiltrate data from government and research targets across numerous countries; the document also provides detection guidance and a view of the group's infrastructure.