Snake: what is this Russian software, 20 years old, neutralized by the United States?

2023-05-10 01:29:44

“US law enforcement has neutralized one of Russia’s most sophisticated cyber-espionage tools.” Announcement made by US Deputy Justice Minister Lisa Monaco on Tuesday. Washington implemented “a high-tech operation”, which turned “this Russian malware against itself”. But what was this software really doing?

Capable of “stealing hundreds of sensitive documents”

Dubbed “Snake”, it is considered by the US Cyber ​​Defense Agency (Cisa), “the most sophisticated cyber-espionage tool in the FSB’s arsenal”. It allowed Russian intelligence services to “steal hundreds of sensitive documents in at least 50 countries”, including attacking the computer services of governments, media or research centers, according to a press release from the US Department of Justice.

With U.S. & international partners, we released a joint cybersecurity advisory on Snake malware, which is considered the most sophisticated cyber espionage tool designed and used by #Russia’s Federal Security Service. Here’s how to protect your networks: pic.twitter.com/MVkNzZXSTb

— Cybersecurity and Infrastructure Security Agency (@CISAgov) May 9, 2023

“Snake” had been known to cybersecurity experts for at least ten years. The Cisa places its date of creation around 2003 and estimates that it has undergone numerous updates over time. “It surprisingly has very few computer bugs, which is surprising given its complexity,” also notes the American agency.

Also known as “Uroboros”

According to US authorities, “Snake” was guided from an FSB unit called “Turla”, located in Ryazan, Russia. He could identify and steal documents and remain undetected indefinitely. Its specificity: the agents of “Turla” exfiltrated this data using the global network of infected computers.

In 2018, the German Foreign Ministry revealed that it had been the subject of an unprecedented attack attributed by the media to the “Snake” software, also known as “Uroboros”. Victims have also been identified in Belgium, Ukraine, the United States, Switzerland or Georgia.

After studying this software for many years, the American federal police succeeded in creating a tool, baptized “Perseus”, capable of communicating with “Snake” and ordering it to shut down without involving the host computer. It was put out of harm’s way during Operation Medusa conducted by the FBI, in coordination with foreign partners.