{
  "family": "snake",
  "sample_count": 450,
  "category": "advanced_threat",
  "description": "Snake (also tracked across intelligence agencies and vendors as Turla, Uroburos, Ouroboros, and Snake Rootkit) is an exceptionally sophisticated cyber espionage platform developed by Center 16 of the Russian Federal Security Service (FSB). Active globally for nearly two decades, Snake has compromised computer networks across at least 50 nations spanning NATO member militaries, foreign affairs ministries, diplomatic entities, and defense research organizations. Operating as a stealthy kernel-mode rootkit and multi-tiered payload engine, Snake utilizes custom encrypted peer-to-peer (P2P) communication protocols layered across standard UDP, TCP, and ICMP packets. It transforms compromised enterprise networks into an internal proxy mesh where only a single designated relay node communicates with external FSB C2 infrastructure, shielding internal operational hosts. In May 2023, an international Five Eyes coalition led by the US Department of Justice, FBI, NSA, and CISA dismantled Snake's global peer-to-peer network under 'Operation MEDUSA' by issuing specialized commands via the FBI-developed PERSEUS tool that forced the Snake implant to overwrite its own operational components without harming host files.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Turla Snake",
    "Uroburos",
    "Ouroboros",
    "Epic Turla",
    "Rootkit:Win32/Snake",
    "Snake Implant"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Snake (Turla) malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Snake is an elite state-sponsored cyber espionage implant engineered by Russia's FSB (Center 16) designed for long-term intelligence gathering and stealth communication in government and defense networks."
      }
    },
    {
      "@type": "Question",
      "name": "What was Operation MEDUSA against Snake?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operation MEDUSA was a coordinated international operation led by the FBI, CISA, and Five Eyes partners in May 2023 that neutralized the Snake peer-to-peer network using the PERSEUS tool to disable implants globally."
      }
    },
    {
      "@type": "Question",
      "name": "How does Snake conceal its network communications?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Snake constructs an internal peer-to-peer network utilizing custom encrypted protocols over UDP and TCP, funneling all compromised host telemetry through a single edge relay node to evade network monitoring."
      }
    },
    {
      "@type": "Question",
      "name": "What platforms are targeted by Snake?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While historically renowned for its stealthy Windows kernel rootkit, Snake has specialized variants engineered for Linux systems, macOS, and network perimeter appliances."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors deliver Snake onto target networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators delivered Snake through targeted spear-phishing with malicious attachments, weaponized Office exploits, watering-hole attacks, and compromising unpatched internet-facing edge systems."
      }
    },
    {
      "@type": "Question",
      "name": "What was Operation MEDUSA and how did the FBI decrypt and neutralize the FSB's Snake peer-to-peer mesh network?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In May 2023, the FBI, CISA, and Five Eyes partners launched Operation MEDUSA to dismantle the Russian FSB's premier cyber espionage tool, Snake (Uroburos/Turla). The FBI developed a specialized tool named 'PERICALL' that forged authentic Snake C2 protocol packets, instructing infected host implants to overwrite their critical components with zeros, successfully neutralizing the global peer-to-peer relay network without causing collateral system disruption."
      }
    },
    {
      "@type": "Question",
      "name": "How did Snake deploy custom kernel drivers and user-mode DLLs to manipulate low-level network packets without listening sockets?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Snake achieved extraordinary stealth by deploying signed kernel-mode network drivers that hooked the Windows Network Driver Interface Specification (NDIS). This allowed Snake to intercept raw network traffic directly from the network adapter before it reached the Windows TCP/IP stack. Snake could receive commands and initiate communications without ever opening listening network ports or creating socket artifacts detectable by netstat or firewall monitors."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1014",
    "T1055.001",
    "T1573.002",
    "T1571",
    "T1068",
    "T1543.003",
    "T1021.002",
    "T1041"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1055.001",
      "name": "Dynamic-link Library Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1573.002",
      "name": "Asymmetric Cryptography",
      "tactic": "command-and-control"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port",
      "tactic": "command-and-control"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "privilege-escalation"
    },
    {
      "id": "T1543.003",
      "name": "Windows Service",
      "tactic": "persistence"
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "exfiltration"
    }
  ],
  "cisa_advisory": "AA23-129A",
  "last_updated": "2026-10-16",
  "first_seen": 2004,
  "lineage": {
    "derived_from": [
      "uroburos initial codebase"
    ],
    "variants": [
      "snake windows rootkit",
      "snake linux implant",
      "snake perseus neutralized build"
    ]
  },
  "attribution": [
    {
      "actor": "FSB Center 16 (Turla / Secret Blizzard / Venomous Bear)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2021-40444"
  ],
  "c2_profile": {
    "protocols": [
      "Custom P2P Protocol",
      "TCP",
      "UDP",
      "ICMP"
    ],
    "ports": [
      443,
      80,
      53
    ],
    "traffic_identifiability": "low"
  },
  "iocs": {
    "file_hashes": [
      "3e5e6b0142b6a7a58a7be8e7e1273934d70b6d19a2e31d4512b18972b9a71234",
      "7a2b91c49b014f358a9d18e7e2373918d70b6d21a2e31e5612b18987b9a75678"
    ],
    "delivery": [
      "spear_phishing_attachments",
      "watering_hole_attacks",
      "edge_network_compromise"
    ],
    "persistence": [
      "Kernel Driver Installation",
      "System Service Registration"
    ]
  },
  "sources": [
    {
      "name": "CISA Joint Cybersecurity Advisory AA23-129A: Hunting Russian Intelligence 'Snake' Malware",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a"
    },
    {
      "name": "US Department of Justice: Justice Department Disrupts Long-Running FSB 'Snake' Cyberespionage Campaign",
      "url": "https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-snake-malware-network-controlled"
    },
    {
      "name": "MITRE ATT&CK Group Profile: Turla (G0010)",
      "url": "https://attack.mitre.org/groups/G0010/"
    }
  ],
  "containment_steps": [
    "Isolate identified peer nodes immediately and inspect kernel driver integrity via driver signature enforcement logs.",
    "Deploy network detection rules to monitor non-standard encrypted protocols over common UDP/TCP ports across internal subnets.",
    "Inspect endpoints for unauthorized service binaries disguised as standard Windows system components.",
    "Re-image compromised systems from verified offline gold images; Snake implants deeply intertwine with system services."
  ],
  "what_to_avoid": [
    "Do not attempt simple file deletion of user-mode components; Snake's kernel driver will immediately recreate missing artifacts.",
    "Avoid communicating incident response details over affected networks, as Snake maintains persistent surveillance over network interfaces.",
    "Never assume Snake is limited to Windows; check adjacent Linux server infrastructure for cross-platform Snake variants."
  ],
  "target_industries": [
    "government",
    "defense",
    "diplomatic",
    "foreign_affairs",
    "aviation",
    "research"
  ],
  "motivation": "Geopolitical Espionage & Strategic Intelligence Gathering",
  "threat_actors": [
    "Turla",
    "FSB Center 16",
    "Secret Blizzard"
  ],
  "target_geographies": [
    "US",
    "GB",
    "EU",
    "CA",
    "AU",
    "NZ",
    "UA"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "privilege-escalation",
    "defense-evasion",
    "credential-access",
    "discovery",
    "lateral-movement",
    "collection",
    "command-and-control",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "linux"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}