Saturday , March 15 2025

FBI Disables ‘Sophisticated’ Russian Snake Cyberspying Tool

U.S. officials announced on Tuesday that they had destroyed a worldwide network of compromised computers that Russian intelligence personnel had used to spy on the U.S. and its allies for over 20 years.

It has been reported that a branch of Russia’s Federal Security Service (FSB) stole classified material from hundreds of infiltrated computer networks in at least 50 countries by using malicious software known as Snake.

Researcher found non protected database form ESHYFT containig 86000 records

Cybersecurity researcher Jeremiah Fowler found and reported a non-password-protected database with over 86,000 records belonging to ESHYFT, a New Jersey-based...
Read More
Researcher found non protected database form ESHYFT containig 86000 records

CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws

Forescout Research- Vedere Labs identified a series of intrusion based on two Fortinet vulnerabilities which began with the exploitation of...
Read More
CVE-2024-55591 and CVE-2025-24472  New SuperBlack ransomware exploits Fortinet flaws

CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws

GitLab has released versions 17.9.2, 17.8.5, and 17.7.7 for its Community and Enterprise Editions to fix security vulnerabilities, including a...
Read More
CVE-2025-25291 & CVE-2025-25292  Attention! GitLab Patched Critical Authentication Bypass Flaws

CVE-2025-20138
Cisco released High Security Alert for IOS XR Software

Cisco has issued a security advisory for a high-severity vulnerability in its IOS XR Software, labeled CVE-2025-20138, with a CVSS...
Read More
CVE-2025-20138  Cisco released High Security Alert for IOS XR Software

400+ IPs Exploiting Multiple SSRF Vulnerabilities

GreyNoise warns of a coordinated increase in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities across various platforms. "At least...
Read More
400+ IPs Exploiting Multiple SSRF Vulnerabilities

NVIDIA has released update for NVIDIA Riva

NVIDIA has released a software update for Riva to fix security vulnerabilities that could allow privilege escalation, data tampering, denial...
Read More
NVIDIA has released update for NVIDIA Riva

CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”

On Tuesday, Apple fixed a critical zero-day vulnerability affecting nearly all supported iPhones and iPads. The company noted that it...
Read More
CVE-2025-24201  Apple fixes 0-day exploited in “extremely sophisticated attack”

Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws

Microsoft's March 2025 Patch Tuesday update fixes 57 flaws, including seven zero-day exploits, six of which are actively being exploited....
Read More
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws

Ballista Botnet infects 6000 Unpatched TP-Link Routers

Cato CRTL team said, a new botnet campaign dubbed Ballista target the unpatched TP-Link Archer routers. CVE-2023-1389 is a serious...
Read More
Ballista Botnet infects 6000 Unpatched TP-Link Routers

CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE

A critical vulnerability, CVE-2025-24813, has been found in Apache Tomcat, which could let attackers execute remote code, leak sensitive data,...
Read More
CVE-2025-24813  Flaw in Apache Tomcat Exposes Servers to RCE

According to the Russian government, the compromised computers belonged to NATO member governments, journalists, and other individuals of interest.

The information was sent back to Russia using hacked computers in the United States and elsewhere.

According to the Department of Justice, Snake is the “leading cyberespionage malware implant” used by the FSB.

“The Justice Department, together with our international partners, has dismantled a global network of malware-infected computers that the Russian government has used for nearly two decades to conduct cyber-espionage, including against our NATO allies,” said Attorney General Merrick Garland. In response to the Russian regime’s efforts to undermine U.S. and allied security, “continued strengthening of our collective defenses” will be implemented.”

The Justice Department announced that the FBI’s Operation MEDUSA successfully dissolved the Snake network with judicial approval. The operation used a tool developed by the FBI called PERSEUS to remove the Snake virus from infected machines.

Officials have stated that the department is collaborating with foreign governments in order to inform further people who have contracted the Snake sickness.

For more than twenty years, the FBI has monitored Snake and other malware programs, eventually creating the means to decrypt and decode communications involving Snake.

In a statement, Deputy Attorney General Lisa Monaco claimed that the takedown “has neutralized one of Russia’s most sophisticated cyber-espionage tools, used for two decades to advance Russia’s authoritarian objectives.”

“By combining this action with the release of the information victims need to protect themselves, the Justice Department continues to put victims at the center of our cybercrime work and take the fight to malicious cyber actors,” Monaco said.

The FSB Turla unit, according to court records unsealed on Tuesday, operated the Snake robot out of a known FSB base in the Russian city of Ryazan to carry out everyday espionage activities.

In order to maintain its status as “Turla’s most sophisticated long-term cyberespionage malware implant,” the unit has modified and changed the virus on multiple occasions, as stated by the Justice Department.

Conclusion

On Tuesday, the U.S. government disrupted a global network infected by Russia’s Federal Security Service (FSB) Snake virus. Snake, the “most sophisticated cyber espionage tool,” was created by Turla (aka Iron Hunter, Secret Blizzard, SUMMIT, Uroburos, Venomous Bear, and Waterbug), a Russian state-sponsored entity the U.S. government attributes to Center 16 of the FSB. The threat actor has previously focused on Europe, the Commonwealth of Independent States (CIS), and NATO countries.

Still, it has recently expanded to include Middle Eastern nations considered a threat to Russia-supported regional countries. “For nearly 20 years, this unit has used versions of the Snake malware to steal sensitive documents from hundreds of computer systems in at least 50 countries, which have belonged to North Atlantic Treaty Organization (NATO) member governments, journalists, and other targets of interest to the Russian Federation,” the Justice Department said. “After stealing these documents, Turla exfiltrated them through a covert network of unwitting Snake-compromised computers in the United States and worldwide.”

Check Also

NTT

Cyber attack at Japanese telecom leader NTT hits 18,000 companies

NTT Communications Corporation discovered illegal access to its facilities on February 5 and confirmed on …

Leave a Reply

Your email address will not be published. Required fields are marked *