HOMETHREATSturian
APT / THREAT GROUP

turian

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to Mitre, Turian is a backdoor that has been used by BackdoorDiplomacy to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, Turian is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.

Threat Analysis

turian is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://unit42.paloaltonetworks.com/playful-taurus/
→https://www.fortinet.com/blog/threat-research/analysis-of-follina-zero-day
→https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.turianturian

External Intelligence

Malpedia: win.turian

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search turian