Article
Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse
Turla profile: aliases such as Snake, Uroburos and Secret Blizzard, active since the early 2000s, modular malware including Kazuar, and typical targets.
Read more
Malware profile
Snake (Uroburos)
Also known as Uroburos, Snake
Snake, also called Uroburos, is a cyber espionage implant written in C, with versions for Windows, Linux and macOS.
In short
Snake, also called Uroburos, is a cyber espionage implant written in C, with versions for Windows, Linux and macOS. US and allied agencies attribute it to a unit in Center 16 of Russia's Federal Security Service (FSB), which they say used it for long-term intelligence collection. It hides on the host, and its infected machines form a covert peer-to-peer network that relays stolen data.
- Names2names in public reportsSnake · Uroburos
- Techniques19ATT&CK techniques listedCommand and Control · Stealth · Persistence
- Infection Steps6in the delivery chainInstaller runs · Components unpacked
- Linked Groups1groups that use itTurla
In one minute
- What it is
- A cyber espionage implant written in C, with versions for Windows, Linux and macOS, built to stay hidden on a host for months or years.
- What it does
- Collects files and credentials for intelligence gathering and links infected machines into a covert peer-to-peer network that relays traffic back to its operators.
- Who uses it
- Attributed by the US, UK, Canada, Australia and New Zealand governments (joint advisory, 9 May 2023) to a unit within Center 16 of Russia's FSB. The advisory links the unit to the Turla toolset.
- How it gets in
- The sources do not state the first way in. The advisory says Snake is typically deployed to external-facing nodes, and operators then use stolen administrator credentials inside the network.
- What to do first
- Read CISA advisory AA23-129A, which carries network and host detection rules, and treat any hit as a reason to change credentials from a clean system and start your incident response plan.
What it does
The joint advisory says the FSB usually deploys Snake on external-facing nodes of a target network. From there it uses other tools on the internal network, such as keyloggers, network sniffers and open source tools, to find administrator credentials and reach domain controllers. In most cases it does not add further heavy implants, and relies on stolen credentials and light remote access tools.
The US Department of Justice announced on 9 May 2023 that the FBI had disabled Snake on computers in the US under a court-authorized operation called MEDUSA. The Department said this did not patch any vulnerabilities or remove other tools attackers may have left, so victims still needed to follow the advisory.
MITRE ATT&CK lists Turla, the group behind Snake, as a user of other tools too, for example Kazuar.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Snake | MITRE ATT&CK Associated Software for S0022, and the name used throughout CISA advisory AA23-129A and the DOJ affidavit[1, 2, 4] |
| Uroburos | MITRE ATT&CK software name for S0022. The advisory says the FSB began developing Snake as Uroburos in late 2003[1, 2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Command and Control
Application Layer Protocol: Web Protocols T1071.001
It uses a custom protocol that rides on standard HTTP, so large data transfers can blend with normal web traffic.[1]
Application Layer Protocol: DNS T1071.004
It encodes outbound command traffic in DNS requests made to look like ordinary domain names.[1]
Proxy: Multi-hop Proxy T1090.003
Implants on many compromised machines pass its traffic along through a worldwide peer-to-peer network.[1, 2, 3]
Fallback Channels T1008
It can use up to 10 channels to communicate between implants.[1]
Encrypted Channel: Symmetric Cryptography T1573.001
It adds a layer of CAST-128 encryption beneath its HTTP or TCP session encryption, with a separate key for each direction.[1]
Encrypted Channel: Asymmetric Cryptography T1573.002
It protects the top layer of its command traffic with a Diffie-Hellman key exchange mixed with a pre-shared key.[1]
Traffic Signaling T1205
It checks the first packet of a TCP connection for a value unique to the implant and passes other traffic on to the real application.[1]
Ingress Tool Transfer T1105
It has a Put command that writes files to the infected machine.[1]
Stealth
Rootkit T1014
Its kernel module hides its own components from operating system listings and handles requests between user mode and the hidden parts.[1, 2]
Hide Artifacts: Hidden File System T1564.005
It keeps its files in a concealed NTFS or FAT-16 file system that is encrypted with CAST-128.[1, 2]
Masquerading: Masquerade Task or Service T1036.004
It has registered a service named WerFaultSvc, likely to pass for the Windows error reporting service.[1, 2]
Obfuscated Files or Information: Fileless Storage T1027.011
It keeps configuration for its kernel driver and loader in an encrypted blob in the Registry.[1]
Reflective Code Loading T1620
It can load new modules straight into memory with a command built for that.[1]
Indicator Removal: File Deletion T1070.004
It has a command that deletes Snake-related logs on an infected machine.[1]
Process Injection: Dynamic-link Library Injection T1055.001
It can use DLL injection to load its embedded files and modules.[1]
Persistence
Collection
How it spreads
The sources reviewed do not state how Snake first reaches a victim. The joint advisory says it is typically deployed to external-facing infrastructure nodes, and that its prevention advice is not meant to protect against the initial access vector. The advisory also says the FSB re-infected systems that stopped responding to Snake communications, within days.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Installer runs
A packed installer, often named jpsetup.exe, needs two command line arguments. They are used to decrypt an AES encrypted resource that becomes a second-stage executable.[2]
Components unpacked
The second stage extracts many components from its resources, and these become the host files of Snake.[2]
Service registered
A service, typically named WerFaultSvc, is registered to blend in with the Windows error reporting service. At boot it runs a WerFault.exe that Snake hides among the real ones.[2]
Registry blob decrypted
That program decrypts a blob in the Registry, typically under HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. It holds the key, IV and path for the next file.[2]
Kernel driver loaded
The path leads to a single encrypted file, typically comadmin.dat, that holds the kernel driver and its loader. Snake's components are decrypted and loaded into memory.[2]
Implant injected
The main user mode component is injected into a chosen process, and the kernel driver hides the host files.[2]
Timeline
- Late 2003
Development begins
The joint advisory says the FSB began developing Snake as Uroburos in late 2003.[2]
- Early 2004
First operations
The advisory says the first versions looked complete around early 2004, and operations with the implant began shortly after.[2]
- 2004
Wide use by Turla
The FBI affidavit says that as early as 2004 Turla made extensive use of versions of the malware it named Uroburos and later Snake.[4]
- 2014
Developer string changed
The advisory says a string in the code was replaced with another in 2014, after some public cybersecurity reporting.[2]
- 9 May 2023
Operation MEDUSA announced
The Department of Justice announced a court-authorized operation in which the FBI used a tool named PERSEUS to make Snake overwrite its own vital components.[3]
- 9 May 2023
Who uses it
Detection and defense
Use the official detection resources
CISA advisory AA23-129A carries Suricata rules for Snake network traffic, a YARA rule for the WerFault.exe icon sizes, a YARA rule for high-entropy files, and a Volatility plugin for memory. The advisory warns that some network signatures can give false positives and that operators can change them.[2]
Look for the covert store and Registry blob
The advisory says the hidden file system is encrypted, so single file signatures are weak, and many host artifacts can be moved or renamed. Its host checks cover the covert store and an encrypted Registry value under the .wav key.[2]
Change credentials from a clean system
The advisory says Snake uses a keylogger that sends logs back to operators. Owners who think they are compromised should change usernames and passwords from a non-compromised system and avoid passwords like the old ones. The Department of Justice says stolen credentials could let Turla get back in.[2, 3]
Counters: T1056.001
Do not stop at the takedown
The Department of Justice says Operation MEDUSA did not patch vulnerabilities or remove other tools attackers may have left, so victims should read the joint advisory and follow its steps.[3]
Questions
What is Snake (Uroburos)?
MITRE ATT&CK describes it as a cyber espionage tool written in C, used by units within Russia's FSB associated with the Turla toolset. The joint advisory says the FSB began developing it as Uroburos in late 2003.
Who is behind Snake?
The US and its partners attribute Snake, in the joint advisory of 9 May 2023, to a known unit within Center 16 of the FSB. The Department of Justice says court documents call this unit Turla.
What was Operation MEDUSA?
The Department of Justice announced on 9 May 2023 a court-authorized FBI operation against the Snake network. The FBI tool PERSEUS sent commands that made Snake overwrite its own vital components, without harming the host computer.
How does Snake reach a network?
The sources reviewed do not say how it first gets in. The advisory says the FSB typically deploys Snake to external-facing nodes and then moves inside the network with stolen credentials and other tools.
How can defenders look for Snake?
CISA advisory AA23-129A has Suricata network rules, YARA rules, and a Volatility plugin. The advisory says memory analysis is the most effective method.
In our research
- Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse March 2026
- Turla Threat group
Sources
- Uroburos, Software S0022 MITRE ATT&CKSupports: Description, platforms, associated software Snake, techniques and the Turla link.
- Hunting Russian Intelligence Snake Malware, AA23-129A CISA, FBI, NSA, CNMF and partner agenciesSupports: Attribution to FSB Center 16, history from 2003, architecture, installation, detection rules, mitigations.
- Justice Department Announces Court-Authorized Disruption of Snake Malware Network Controlled by Russia's Federal Security Service US Department of JusticeSupports: Operation MEDUSA, PERSEUS tool, 9 May 2023, credentials warning and limits of the operation.
- Affidavit in support of search warrant, Snake malware network, 23-MJ-0428 US Department of Justice, Eastern District of New YorkSupports: Names used for the actor, Uroburos then Snake, use from as early as 2004, the Snake network.
- UK and allies expose Snake malware threat from Russian cyber actors UK National Cyber Security CentreSupports: Joint advisory published 9 May 2023 by the UK, US, Canada, Australia and New Zealand.
- Turla, Group G0010 MITRE ATT&CKSupports: MITRE group page for Turla, which lists Uroburos among its software.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.