Hunting Russian Intelligence “Snake” Malware

[taubek]

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

[Fatty123]

This is disturbing. I found the dll's and registry changes on my system. From the dates they've been running for just over a year.

[costco → Fatty123]

Out of curiosity what line of work are you in? Definitely report (https://www.cisa.gov/report) it!

[funerr → Fatty123]

What did you exactly do to find it?

[godelski → funerr]

There's instructions for Windows at the bottom

[GartzenDeHaes]

So Russia's flagship malware is an EXE?

[saagarjha → GartzenDeHaes]

> We have observed interoperable Snake implants for Windows, MacOS, and Linux operating systems.

Doesn’t look like it’s just exes.

[mdhb → GartzenDeHaes]

Also unsure if it’s still the flagship at this point. It’s 20 years old. I think that speaks a lot to the complicated layering and indirection they put in it that it survived so long.

[halJordan → mdhb]

It's been iterated on. Kinda like saying Office has been here for twenty years, it's probably not a flagship anymore.

[caycep]

The first thing that came to mind is Sean Connery saying "One ping, Vasily, one ping only"

[sdfghswe → caycep]

Best soundtrack.