Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
The FBI in coordination with Five Eyes intelligence partners have shared in-depth information ,as well as details on a recent disruption of infrastructure for Snake malware. Snake is an implant developed and used by the Russian state-affiliated APT group Turla (aka. Venomous Bear, Waterbug). Snake is used to establish long-term persistence on victim devices and stealthily exfiltrate sensitive data. The malware has been identified impacting organizations in over 50 countries including the U.S., with victim industries including government, critical infrastructure, education, media, finance, and communications.
On May 9th, the U.S. Department of Justice announced the authorized disruption of the Snake malware network. A joint department operation resulted in the disruption of the network, and law-enforcement is in the process of notifying all impacted organizations. Organizations identified as impacted by the now disrupted malware are recommended to perform a full security review, as Snake is an indicator for a wider breach and potentially other malware or persistent access.
The creation of Snake malware has been traced back to 2003, with its initial use by the Turla APT group occurring in 2004. It should be noted that Turla is directly attributed to Russia's Federal Security Service (FSB) and acts at the behest of the Russian government. Snake is described as “the FSB's most sophisticated long-term cyberespionage malware implant". The malware maintains high levels of stealth by operating as a peer-to-peer (P2P) network, using other infected machines for communication. Turla has used Snake malware to remotely install additional malicious content, steal sensitive documents, and maintain long-term persistence in compromised networks.
The malware has been frequently updated since its initial release, with major updates occurring after technical analyses released by security vendors. The eSentire Threat Intelligence team assesses with high confidence that despite law-enforcement actions, Russian APTs will continue to employ new version of Snake malware in future attacks.
The FBI disrupted all infected devices located in the United States as part of Operation Medusa. Information from this operation has been shared with governments outside of the U.S. to enable international remediation. By analyzing Snake malware, the FBI was able to decrypt/decode Snake communications; leading to the development of a tool dubbed Perseus. Perseus establishes communication sessions with Snake and issues a command leading to Snake disabling itself. This campaign will significantly impact Turla’s capabilities in the short term, but it should be noted that the disabling of Snake malware will not impact other malware that may have been deployed after initial access was gained.
The eSentire Threat Intelligence team is continuing to track information related to both Turla and Snake malware for additional insight and detection opportunities.
References:
[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
[2] https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware.pdf
[3] https://www.documentcloud.org/documents/23808246-operation-medusa-press-release