Turla, the Snake of Attribution

Turla (aka Snake) is presented as a Russia-linked, highly capable espionage APT active since ~2006, targeting governments, military, and press. The report highlights advanced capabilities (custom malware, obfuscation, zero-days, Exchange transport agent persistence, ISP-level MITM, satellite internet link hijacking), operational OPSEC failures, and deliberate false-flag behaviors including planting or reusing Chinese and Iranian malware and reportedly taking over Iranian infrastructure; it emphasizes that attribution is an assessment rather than absolute.