Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Is this Russia's Stuxnet? Security firm spots suspicious 'Uroburos' rootkit

Links to 2008 'Agent.btz' attack on US military

Article comments

‘Uroburos’ is an advanced rootkit that has been infecting networks since as far back as 2011, quietly stealing data after setting up rogue P2P networks within its high-level targets.

It’s modular, displays unusual complexity and is suspiciously discreet. Almost certainly programmed in Russia (from references in the code), it checks targets for the presence of the USB stick-loving Agent.btz (‘Buckshot Yankee’), a mostly-forgotten worm that successfully got behind US military firewalls in 2008. If it finds it, it does not activate.

According to German security firm G Data, which has researched the new malware, the latter is a bit of a giveaway because Agent.btz was also almost certainly of Russian origin. Circumstantially, a Reuters report later quoted a US military source as blaming Russia.

It’s not quite the Kremlin Stuxnet perhaps, but might Uroburos be the first confirmed example of a well-established Russian government cyber-weapons programme? One piece of suspicious malware is interesting, two downright odd.

“This malware behaviour is typical for propagation in networks of huge companies or public authorities. The attackers expect that their target does have computers cut off from the Internet and uses this technique as a kind of workaround to achieve their goal,” said G Data in a teaser before it reveals a more detailed analysis. We’re all ears.

“According to all indications we gathered from the malware analyses and the research, we are sure of the fact that attacks carried out with Uroburos are not targeting John Doe but high profile enterprises, nation states, intelligence agencies and similar targets.”

Dating back to 2011 according to compile dates,  its mode of infection remains a mystery but take your pick after starting with USB sticks. What G-Data has not worked out is the target list of Uroburos; without that its function and status as a cyberweapon remain a matter of inference. Certainly, professional cybercriminals don't make malware this Byzantine.

For the record, the name Uroburos (or, more commonly, 'Ouroboros') comes from a string found in the malware, and references an ancient Egyptian symbol of a serpent eating its own tail. For cyberwar experts, never a dull moment.

Update: an updated and expanded analysis is now available.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *