Threat intelligence / Malware

Uroburos

[Uroburos](https://attack.mitre.org/software/S0022) is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the [Turla](https://attack.mitre.org/groups/G0010) toolset to collect intelligence on sensitive targets worldwide. [Uroburos](https://attack.mitre.org/software/S0022) has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. [Uroburos](https://attack.mitre.org/software/S0022) is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. [Uroburos](https://attack.mitre.org/software/S0022) has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)(Citation: Kaspersky Turla)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Uroburos](https://attack.mitre.org/software/S0022) is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the [Turla](https://attack.mitre.org/groups/G0010) toolset to collect intelligence on sensitive targets worldwide. [Uroburos](https://attack.mitre.org/software/S0022) has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. [Uroburos](https://attack.mitre.org/software/S0022) is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. [Uroburos](https://attack.mitre.org/software/S0022) has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)(Citation: Kaspersky Turla)

Labels

malware

37 recorded

Relationships

uses

from Turla

Group

uses

to Asymmetric Cryptography

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Embedded Payloads

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Hidden File System

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inter-Process Communication

Technique

uses

Technique

uses

to Mail Protocols

Technique

uses

to Masquerade Task or Service

Technique

uses

to Modify Registry

Technique

uses

to Multi-hop Proxy

Technique

uses

to Multi-Stage Channels

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Encoding

Technique

uses

to Process Discovery

Technique

uses

to Protocol or Service Impersonation

Technique

uses

to Protocol Tunneling

Technique

uses

to Query Registry

Technique

uses

to Reflective Code Loading

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to Traffic Signaling

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

4 external

References

mitre-attack

S0022

Snake

—

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf

Kaspersky Turla

https://securelist.com/the-epic-turla-operation/65545/