Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Invisible Russian cyberweapon stalked US and Ukraine since 2005, new research reveals

Sophisticated 'Snake' malware discovered

Article comments

The mysterious ‘Uroburos’ cyberweapon named last week in Germany has been stalking its victims since as far back as 2005 and large enterprises and governments need to pay urgent attention to the threat it poses, UK security firm BAE Systems has urged.

German firm G Data’s recent analysis dubbed it ‘Uroburos’ while it is also known to some security firms as 'Turla'. BAE Systems’ Applied Intelligence division, which today published its own research, prefers the catchier ‘Snake’ but under any name the picture is alarming.

According to BAE Systems, It now transpires that Snake has been slithering silently around networks in the US and its NATO allies and former Soviet states for almost a decade, stealing data, getting ever more complex and modular and remaining almost invisible.

To be clear, this isn’t any old malware.  Snake is just too long-lived, too targeted, too sophisticated, too evasive, too innovative. It appears to be on par with any of the complex cyberweapons attributed to the US such as Flame, first analysed by Kaspersky Lab in 2012.

After several months of research, the UK firm takes what we know a lot further, offering for the first time some objective data on targets. Culling data from malware research sites (i.e. those to which suspected malware samples are submitted for inspection), it has been spotted 32 times in the Ukraine since 2010, 11 times in Lithuania, 4 times in the UK, and a handful of times altogether from the US, Belgium, Georgia, Romania, Hungary and Italy.

These are very small numbers but BAE Systems believes that on past experience they are highly indicative. While they represent a tiny fraction of the number of infections that will have occurred in these countries and beyond, they can be used to reliably infer that Snake has been aimed at Western and Western-aligned countries pretty much exclusively.

In a week Russia planted boots on the ground in the Crimean region of the Ukraine, this is an unfortunate coincidence because while BAE Systems refused to name the state as the culprit, G Data and others are convinced that the links are suspicious.  

Hints of the malware’s provenance have surfaced from time to time. In 2008, the US Department of Defense (DoD) reported that something called, Agent.btz had attacked its systems, an incident later attributed on more than one occasion to the Russian state without further elaboration.  

Beyond that the evidence becomes circumstantial. If we assume that Agent.btz was probably an early variant of Snake, the malware also contains other clues; compile times show a time offset of UTC+4 hours while Russian references have been found in the code. Ergo, because this is clearly not commercial malware and would have required large development resources, Snake was made by a government beginning with ‘R’.

“The element of attribution is always difficult,” BAE Systems Applied Intelligence cybersecurity managing director David Garfield told Techworld. “It turns into conjecture and it would be dangerous to make too many guesses.”

“But this is a call to arms. [This malware] is high complex. It has all the elements of an espionage toolkit. It is highly serious.”

Interestingly – perhaps uniquely that we know of – the firm has already informed governments, policy makers and national CERTs of its findings in advance of publishing its research, he said.

He expected that there had been, indeed still were, numerous variants inside target networks, something that would make remediation complex and time-consuming.

Whether called Uroburos, Snake or Turla (the latter being the 32-bit rootkit), it is also possible that what security firms have been seeing since 2010 is actually several inter-related cyber-weapons from the same program, hence the confusion over variants. In that interpretation, Snake isn't a cyberweapon so much as a stable of espionage tools in the same way that Stuxnet was part of a larger arsenal.

BAE Systems does reveal one or two interesting snippets  about the people who made Snake; compile times show they work Monday-Friday, only rarely putting out a variant at the weekend.  That sounds mildly reassuring; professional cybercriminals are not mindless robots and are paid to do the job just like the rest of us.

“What this research once more demonstrates is how organised and well-funded adversaries are using highly sophisticated tools and techniques to target legitimate organisations on a massive scale,” said BAE Systems Applied Intelligence managing director, Martin Sutherland.

“Although there has been some awareness of the Snake malware for some years, until now the full scale of its capabilities could not be revealed, and the threat it presents is clearly something that needs to be taken much more seriously.”

Separately, G Data has updated its earlier analysis of Snake/Uroburos, noting the rootkit module’s use of a vulnerability (CVE-2008-3431) to bypass Microsoft’s Driver Signature Enforcement systems on 64-bit versions of Windows from Vista onwards, basically a way to fool the OS into thinking it is running in developer mode.  This bypass is not brand new but it still unusual.


More from Techworld

More relevant IT news


Eric said: I like how the 2 guys at the bottom who are attacking the article both erroneously use NASA to refer to the NSAChina has their penny army of copy-pasting government-image defenders and it looks like Russia does too now

Just Me! said: Going to get rid of my computers and get a regular phone no smart crap Im done with computers and then the news always saythat its taken care and its only because they are told to do so only to not worry people so they dont lose money

Just Me! said: Yep I hate computers there is always something fishy and there is no privacy always havin to worry bout hackers scammers viruses sheesh ever since Internet its brought more harm even to families than good

Kolonel Panik said: Oh do let us know your conclusions Its clear that you are no journalist so we can trust you when you decide which is the true perpetratorThe NASA sic or the NSA

1lumpsum said: And we know this was not made by the NASA how We dont The NSA has been proven to be spying on other US agencies and our allies Ill wait to see what Edward Snowden releases on this before believing journalist hyperbole

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *