Loading malware…
Snake, also known as Uroburos, is a modular cyberespionage implant and rootkit developed and operated by the Russian state-affiliated Turla threat group, also known as Venomous Bear and Waterbug. It targets 32-bit and 64-bit Microsoft Windows systems, providing long-term persistence, arbitrary command execution, file theft, network-traffic capture, and concealment of malicious activity. Its architecture includes a kernel driver and an encrypted virtual file system that stores supporting components and data.
Snake supports peer-to-peer communication between infected hosts, allowing operators to control systems without direct Internet access and relay stolen information through other compromised machines. This architecture supports lateral movement and covert exfiltration within segmented enterprise and government networks. Uroburos variants abuse a vulnerable signed VirtualBox driver to disable Windows Driver Signature Enforcement and PatchGuard, enabling unsigned kernel components to operate while bypassing platform protections.
Snake has been used against government institutions and other high-value espionage targets, including a publicly reported compromise of Belgian government networks involving theft of documents concerning the Ukraine crisis. Its initial infection mechanism is not established. Snake/Uroburos is distinct from both the EKANS ransomware family and the unrelated .NET-based Snake Keylogger information stealer.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The first type of downloader we’ve seen used to deploy Snake are RTF documents containing the well-known Microsoft Office Equation Editor exploit (CVE-2017-11882). | Snake is a modular .NET keylogger and credential stealer first spotted in late November 2020.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Snake is an implant developed and used by the Russian state-affiliated APT group Turla (aka. Venomous Bear, Waterbug). Snake is used to establish long-term persistence on victim devices and stealthily exfiltrate sensitive data.
Les victimes étaient des entités ministérielles, visées par exemple en 2014 par le code malveillant Uroburos.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
71 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
104 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a comparison for bitmap-based payload concealment and for a Telegram-supported Malware-as-a-Service sales model. The reference does not establish a shared campaign or operator with DarkVision.
A keylogger and information stealer.
Russian malware used against Ukrainian government systems in the context of pre-invasion cyber espionage and disruption.
A sophisticated long-term cyberespionage implant used for covert access, persistence, and strategic intelligence collection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.