THE THREAT
The FBI in coordination with Five Eyes intelligence partners have shared in-depth information ,as well as details on a recent disruption of infrastructure for Snake malware. Snake is an implant developed and used by the Russian state-affiliated APT group Turla (aka. Venomous Bear, Waterbug). Snake is used to establish long-term persistence on victim devices and stealthily exfiltrate sensitive data. The malware has been identified impacting organizations in over 50 countries including the U.S., with victim industries including government, critical infrastructure, education, media, finance, and communications.
On May 9th, the U.S. Department of Justice announced the authorized disruption of the Snake malware network. A joint department operation resulted in the disruption of the network, and law-enforcement is in the process of notifying all impacted organizations. Organizations identified as impacted by the now disrupted malware are recommended to perform a full security review, as Snake is an indicator for a wider breach and potentially other malware or persistent access.
What we’re doing about it
- eSentire MDR for Network has multiple rules in place to identify Snake variants
- eSentire security teams are reviewing relevant releases for new detection opportunities
- The eSentire Threat Intelligence Team is actively tracking this threat for additional details
What you should do about it
- To limit the risk of impact, ensure operating systems (Windows, Linux, and macOS) are up to date, as modern systems are significantly more difficult to operate in kernel space
- If Snake malware is confirmed, execute an Organizational Incident Response Plan that includes:
- If contacted by the FBI in relation to Snake malware, please notify the eSentire Security Operations Center to allow for additional investigation
- Reset credentials
- Enforce password best practices
- Separate user and privileged accounts (Policy of Least Privilege)
- Ensure proper network segmentation
- Enforce the use of Multi-Factor Authentication (MFA)
Additional information
The creation of Snake malware has been traced back to 2003, with its initial use by the Turla APT group occurring in 2004. It should be noted that Turla is directly attributed to Russia's Federal Security Service (FSB) and acts at the behest of the Russian government. Snake is described as “the FSB's most sophisticated long-term cyberespionage malware implant". The malware maintains high levels of stealth by operating as a peer-to-peer (P2P) network, using other infected machines for communication. Turla has used Snake malware to remotely install additional malicious content, steal sensitive documents, and maintain long-term persistence in compromised networks.
The malware has been frequently updated since its initial release, with major updates occurring after technical analyses released by security vendors. The eSentire Threat Intelligence team assesses with high confidence that despite law-enforcement actions, Russian APTs will continue to employ new version of Snake malware in future attacks.
The FBI disrupted all infected devices located in the United States as part of Operation Medusa. Information from this operation has been shared with governments outside of the U.S. to enable international remediation. By analyzing Snake malware, the FBI was able to decrypt/decode Snake communications; leading to the development of a tool dubbed Perseus. Perseus establishes communication sessions with Snake and issues a command leading to Snake disabling itself. This campaign will significantly impact Turla’s capabilities in the short term, but it should be noted that the disabling of Snake malware will not impact other malware that may have been deployed after initial access was gained.
The eSentire Threat Intelligence team is continuing to track information related to both Turla and Snake malware for additional insight and detection opportunities.
References:
[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
[2] https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware.pdf
[3] https://www.documentcloud.org/documents/23808246-operation-medusa-press-release
