# MA-940.052023: MyCERT Advisory - Snake Malware Threat From Russian Cyber Actors

**Date:** 25 May 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-940.052023  
**Advisory ID:** MA-940.052023

---

**1.0 Introduction**
Recently, The US Cybersecurity & Infrastructure Security Agency (CISA) and partners released a joint advisory for a sophisticated cyber espionage tool used by Russian cyber actors. The advisory titled [Hunting Russian Intelligence “Snake” Malware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a) provides technical descriptions of the malware’s host architecture and network communications, and mitigations to help detect and defend against this threat.
**2.0 Impact**
Snake can be considered to be the most sophisticated cyber espionage tool designed and used for long-term intelligence collection on sensitive targets. The sophistication of Snake stems from three principal areas.
First, Snake employs means to achieve a rare level of stealth in its host components and network communications.
Second, Snake’s internal technical architecture allows for easy incorporation of new or replacement components. This design also facilitates the development and interoperability of Snake instances running on different host operating systems. We have observed interoperable Snake implants for Windows, MacOS, and Linux operating systems.
Lastly, Snake demonstrates careful software engineering design and implementation, with the implant containing surprisingly few bugs given its complexity.
**3.0 Affected Products**
Windows, MacOS, and Linux operating systems.
**4.0 Recommendations**
MyCERT urges organizations to review the [advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a) for more information and apply the recommended mitigations and detection guidance.
Kindly refer to <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a> for more information on Snake malware.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- [https://www.cisa.gov/news-events/alerts/2023/05/09/cisa-and-partners-disclose-snake-malware-threat-russian-cyber-actors](https://www.cisa.gov/news-events/alerts/2023/05/09/cisa-and-partners-disclose-snake-malware-threat-russian-cyber-actors])