Hunting Russian Intelligence “Snake” Malware

The Snake is considered to be the most sophisticated cyber espionage tool in the FSB’s arsenal. The sophistication of Snake stems from three principal areas. First, Snake employs means to achieve a rare level of stealth in its host components and network communications. Second, Snake’s internal technical architecture allows for the easy incorporation of new or replacement components.

This design also facilitates the development and interoperability of Snake instances running on different host operating systems. Interoperable Snake implants for Windows, MacOS, and Linux operating systems have been observed. Lastly, Snake demonstrates careful software engineering design and implementation, with the implant containing surprisingly few bugs given its complexity.