The mysterious 'Uroburos' cyberweapon named last week in Germany has been stalking its victims since as far back as 2005 and large enterprises and governments need to pay urgent attention to the threat it poses, UK security firm BAE Systems has urged.
German firm G Data's recent analysis dubbed it 'Uroburos' while it is also known to some security firms as 'Turla'. BAE Systems' Applied Intelligence division, which today published its own research, prefers the catchier 'Snake' but under any name the picture is alarming.
According to BAE Systems, It now transpires that Snake has been slithering silently around networks in the US and its NATO allies and former Soviet states for almost a decade, stealing data, getting ever more complex and modular and remaining almost invisible.
To be clear, this isn't any old malware. Snake is just too long-lived, too targeted, too sophisticated, too evasive, too innovative. It appears to be on par with any of the complex cyberweapons attributed to the US such as Flame, first analysed by Kaspersky Lab in 2012.
After several months of research, the UK firm takes what we know a lot further, offering for the first time some objective data on targets. Culling data from malware research sites (i.e. those to which suspected malware samples are submitted for inspection), it has been spotted 32 times in the Ukraine since 2010, 11 times in Lithuania, 4 times in the UK, and a handful of times altogether from the US, Belgium, Georgia, Romania, Hungary and Italy.
These are very small numbers but BAE Systems believes that on past experience they are highly indicative. While they represent a tiny fraction of the number of infections that will have occurred in these countries and beyond, they can be used to reliably infer that Snake has been aimed at Western and Western-aligned countries pretty much exclusively.
In a week Russia planted boots on the ground in the Crimean region of the Ukraine, this is an unfortunate coincidence because while BAE Systems refused to name the state as the culprit, G Data and others are convinced that the links are suspicious.
Hints of the malware's provenance have surfaced from time to time. In 2008, the US Department of Defense (DoD) reported that something called, Agent.btz had attacked its systems, an incident later attributed on more than one occasion to the Russian state without further elaboration.
Beyond that the evidence becomes circumstantial. If we assume that Agent.btz was probably an early variant of Snake, the malware also contains other clues; compile times show a time offset of UTC+4 hours while Russian references have been found in the code. Ergo, because this is clearly not commercial malware and would have required large development resources, Snake was made by a government beginning with 'R'.
"The element of attribution is always difficult," BAE Systems Applied Intelligence cybersecurity managing director David Garfield told Techworld. "It turns into conjecture and it would be dangerous to make too many guesses."
"But this is a call to arms. [This malware] is high complex. It has all the elements of an espionage toolkit. It is highly serious."
Interestingly - perhaps uniquely that we know of - the firm has already informed governments, policy makers and national CERTs of its findings in advance of publishing its research, he said.
He expected that there had been, indeed still were, numerous variants inside target networks, something that would make remediation complex and time-consuming.
Whether called Uroburos, Snake or Turla (the latter being the 32-bit rootkit), it is also possible that what security firms have been seeing since 2010 is actually several inter-related cyber-weapons from the same program, hence the confusion over variants. In that interpretation, Snake isn't a cyberweapon so much as a stable of espionage tools in the same way that Stuxnet was part of a larger arsenal.
BAE Systems does reveal one or two interesting snippets about the people who made Snake; compile times show they work Monday-Friday, only rarely putting out a variant at the weekend. That sounds mildly reassuring; professional cybercriminals are not mindless robots and are paid to do the job just like the rest of us.
"What this research once more demonstrates is how organised and well-funded adversaries are using highly sophisticated tools and techniques to target legitimate organisations on a massive scale," said BAE Systems Applied Intelligence managing director, Martin Sutherland.
"Although there has been some awareness of the Snake malware for some years, until now the full scale of its capabilities could not be revealed, and the threat it presents is clearly something that needs to be taken much more seriously."
Separately, G Data has updated its earlier analysis of Snake/Uroburos, noting the rootkit module's use of a vulnerability (CVE-2008-3431) to bypass Microsoft's Driver Signature Enforcement systems on 64-bit versions of Windows from Vista onwards, basically a way to fool the OS into thinking it is running in developer mode. This bypass is not brand new but it still unusual.