Turla
0001-01-01
Turla (aka Snake, Uroburos, Venemous Bear, Krypton) is an Advanced Persistent Threat (APT) group that has been attributed to Russia’s Federal Security Service (FSB).
CrowdStrike labels activity of this group under the moniker of VENEMOUS BEAR: https://www.crowdstrike.com/adversaries/venomous-bear/
Linux Persistence: Modular Software
2025-04-17 DFIR CTF persistence linux persistence apache asterisk
Linux Persistence: Web Shells
2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP
Linux Persistence: Rootkits
2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking
Defanging Linux LKM Rootkits With cleanup_module()
2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit