What We Do
How We Do
Get Started
Security advisories

Snake Malware 

May 9, 2023 | 2 MINS READ

Speak With A Security Expert Now



The FBI in coordination with Five Eyes intelligence partners have shared in-depth information ,as well as details on a recent disruption of infrastructure for Snake malware. Snake is an implant developed and used by the Russian state-affiliated APT group Turla (aka. Venomous Bear, Waterbug). Snake is used to establish long-term persistence on victim devices and stealthily exfiltrate sensitive data. The malware has been identified impacting organizations in over 50 countries including the U.S., with victim industries including government, critical infrastructure, education, media, finance, and communications.

On May 9th, the U.S. Department of Justice announced the authorized disruption of the Snake malware network. A joint department operation resulted in the disruption of the network, and law-enforcement is in the process of notifying all impacted organizations. Organizations identified as impacted by the now disrupted malware are recommended to perform a full security review, as Snake is an indicator for a wider breach and potentially other malware or persistent access.

What we’re doing about it

What you should do about it

Additional information

The creation of Snake malware has been traced back to 2003, with its initial use by the Turla APT group occurring in 2004. It should be noted that Turla is directly attributed to Russia's Federal Security Service (FSB) and acts at the behest of the Russian government. Snake is described as “the FSB's most sophisticated long-term cyberespionage malware implant". The malware maintains high levels of stealth by operating as a peer-to-peer (P2P) network, using other infected machines for communication. Turla has used Snake malware to remotely install additional malicious content, steal sensitive documents, and maintain long-term persistence in compromised networks.

The malware has been frequently updated since its initial release, with major updates occurring after technical analyses released by security vendors. The eSentire Threat Intelligence team assesses with high confidence that despite law-enforcement actions, Russian APTs will continue to employ new version of Snake malware in future attacks.

The FBI disrupted all infected devices located in the United States as part of Operation Medusa. Information from this operation has been shared with governments outside of the U.S. to enable international remediation. By analyzing Snake malware, the FBI was able to decrypt/decode Snake communications; leading to the development of a tool dubbed Perseus. Perseus establishes communication sessions with Snake and issues a command leading to Snake disabling itself. This campaign will significantly impact Turla’s capabilities in the short term, but it should be noted that the disabling of Snake malware will not impact other malware that may have been deployed after initial access was gained.

The eSentire Threat Intelligence team is continuing to track information related to both Turla and Snake malware for additional insight and detection opportunities.

[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
[2] https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware.pdf
[3] https://www.documentcloud.org/documents/23808246-operation-medusa-press-release

View Most Recent Advisories