MITRE ATT&CKsoftware (malware)
S0022 Uroburos
- Domain
- enterprise
- Platforms
- Linux, Windows, macOS
- Aliases
- Snake
- Version
- 2.1
- Created
- 2017-05-31
Description
Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.
Related
Uses · MITRE ATT&CK (36)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.011 Fileless Storage sub-technique
- T1027.009 Embedded Payloads sub-technique
- T1620 Reflective Code Loading technique
- T1564.005 Hidden File System sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1001.001 Junk Data sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.003 Mail Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1090.003 Multi-hop Proxy sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1559 Inter-Process Communication technique
- T1036.004 Masquerade Task or Service sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1543.003 Windows Service sub-technique
- T1055.001 Dynamic-link Library Injection sub-technique
- T1205 Traffic Signaling technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1008 Fallback Channels technique
- T1012 Query Registry technique
- T1014 Rootkit technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0010 Turla group
References
- https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
- https://securelist.com/the-epic-turla-operation/65545/ Kaspersky Turla