# Turla (Snake/Uroburos) Exploits SharePoint Flaw to Breach French Justice-Sector Server

> Russian FSB-linked APT Turla exploited a Microsoft SharePoint vulnerability in 2019 to compromise a French Ministry of Justice continuing-education server, exposing several thousand user accounts. France's Cyber Crisis Coordination Center (C4) and CERT-FR publicly disclosed the intrusion on 2026-07-13 (CERTFR-2026-CTI-004/005), documenting Turla's use of the Uroburos/Snake and Kazuar implants, public tools (Mimikatz, Metasploit), and a global network of compromised servers, CMS-hosted websites, and satellite links as covert relay infrastructure against French government, diplomatic, defense, justice, and technology-sector targets.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1268
- **ID:** TL-2026-1268
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Turla (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Turla (also tracked as Snake, Uroburos, Venomous Bear, Waterbug, Secret Blizzard, WhiteBear, Krypton, Group 88, IRON HUNTER, BELUGASTURGEON) is a long-running cyber-espionage operation run by Center 16 (Military Unit 61240) of Russia's Federal Security Service (FSB), located near Krasnoye Selo outside Saint Petersburg. Active since at least 2004, Turla has compromised government, diplomatic, defense, research, and technology-sector targets in more than 50 countries.

In 2019, Turla exploited a vulnerability connected to Microsoft SharePoint to gain unauthorized access to a server operated by the French Ministry of Justice that hosted a continuing-education (professional training) platform for justice-sector personnel, ultimately exposing several thousand user accounts. France's Cyber Crisis Coordination Center (C4) and the national CERT (CERT-FR/ANSSI) publicly disclosed this and other Turla activity against French entities on 2026-07-13 in reports CERTFR-2026-CTI-004 (French) and CERTFR-2026-CTI-005 (English), describing sustained targeting of French ministries and diplomatic, defense, justice, and technology organizations, including compromise of Ministry of Defense email accounts and the French Embassy network in Moscow, and a February 2025 intrusion at a defense-industry research institute that resulted in significant data exfiltration.

Turla's toolset combines bespoke, long-maintained implants — the Uroburos/Snake rootkit-backdoor (in continuous development since 2003 and the subject of a May 2023 U.S./international disruption effort, Operation MEDUSA, using the FBI-built PERSEUS tool to remotely neutralize Snake implants) and the Kazuar .NET second-stage backdoor (repeatedly updated, most recently reworked from a monolithic implant into a modular peer-to-peer botnet architecture) — with dual-use and legitimate tools including Mimikatz for credential theft and Metasploit for exploitation and post-exploitation. The group further obscures its operations by hijacking third-party infrastructure: compromised or rented servers, websites running content-management systems, satellite communications links, and other actors' infected-machine networks (including infrastructure previously associated with Iranian threat groups) are used as intermediary relays, decoupling victim traffic from FSB-controlled endpoints. Since Russia's February 2022 invasion of Ukraine, Turla has intensified intelligence-collection operations against Ukraine, NATO members, and EU states, of which the newly disclosed French justice-sector compromise is part.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1003 OS Credential Dumping
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1057 Process Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1567 Exfiltration Over Web Service
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy

## Sources

- [Turla Hackers Exploit SharePoint Flaw](https://cybersecuritynews.com/turla-hackers-exploit-sharepoint-flaw/)
- [CERTFR-2026-CTI-004: Ciblage et compromission d'entités françaises au moyen du mode opératoire d'attaque Turla](https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-004/)
- [CERTFR-2026-CTI-005: Targeting and Compromise of French Entities Using the Turla Intrusion Set](https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-005/)
- [Turla, IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON, Group G0010](https://attack.mitre.org/groups/G0010/)
- [Hunting Russian Intelligence "Snake" Malware (AA23-129A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a)
- [Threat Group Assessment: Turla (aka Pensive Ursa)](https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/)
- [Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access](https://thehackernews.com/2026/05/turla-turns-kazuar-backdoor-into.html)
- [Turla Updates Kazuar Backdoor with Advanced Anti-Analysis to Evade Detection](https://thehackernews.com/2023/11/turla-updates-kazuar-backdoor-with.html)
- [Russie et cybercriminalité : ce qu'il faut savoir sur Turla, l'outil attribué au FSB russe](https://www.boursorama.com/actualite-economique/actualites/russie-et-cybercriminalite-ce-qu-il-faut-savoir-sur-turla-l-outil-attribue-au-fsb-russe-179066617cf611bc5910130bc3391664)
- [Turla (Threat Actor) — Malpedia](https://malpedia.caad.fkie.fraunhofer.de/actor/turla)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1268