The Patching Friars' AlmanacA calendar of CVE saints
SnakeHoly card for d-snake, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 P2P Snake MEDUSA VICTRIX
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle V · State espionage

The Demon Snake, the Twenty-Year Serpent

Legend

Used for about twenty years by the Turla group, attributed to Russia's FSB security service, it stole documents from hundreds of systems in at least 50 countries. Infected computers formed a hidden peer-to-peer network. In May 2023 the FBI, with Operation MEDUSA, made it self-destruct with a purpose-built command.

Exorcism

Cast it out with active threat hunting on the most sensitive systems and monitoring unusual encrypted traffic between internal machines. Agencies' technical advisories should be applied as soon as they come out.

Technical record

Also known as
Uroburos, Turla rootkit
Circle
Circle V · State espionage
First seen
c. 2003
Status
Exorcised (Operation MEDUSA, 2023-05-09)

A sophisticated cyber-espionage implant used for about two decades by Turla, a unit of Russia's FSB, to steal documents from hundreds of systems in at least 50 countries. Infected machines formed a covert peer-to-peer network. The FBI's Operation MEDUSA used a tool called PERSEUS to make the implants disable themselves in May 2023.

Sources: attack.mitre.org · attack.mitre.org · justice.gov · cisa.gov · MITRE ATT&CK reference S0022

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.