Snake
Snake is a Russia-attributed ransomware group with an espionage motive, tracked by Brandefense. It targets 10 sectors, including Government and Technology, in 23 countries, including the United States and India. It uses 150 MITRE ATT&CK techniques and exploits 11 known CVEs.
- Snake Ransomware
- IRON HUNTER
- Group 88
- Waterbug
- WhiteBear
- Krypton
- Venomous Bear
- BELUGASTURGEON
- Secret Blizzard
- Origin
- Russia
- Techniques
- 150
- Exploited CVEs
- 11
- First seen
- Jan 1, 2004
- Last seen
- Jul 31, 2025
- Record updated
Who They Target.
About Snake.
Turla is a Russian state-sponsored cyber espionage group attributed in public reporting to Russia's Federal Security Service (FSB), including Center 16 context in government reporting. The group has operated since at least 2004 and has compromised victims in more than 50 countries across government, diplomatic, military, education, research, pharmaceutical, media, finance, manufacturing, telecommunications, and critical infrastructure environments. Turla is known for long-term persistence, advanced custom malware, stealthy command-and-control, proxy and infrastructure hijacking, and selective intelligence collection. Key malware includes Snake Malware, Kazuar, KazuarV2, ApolloShadow, ComRAT, Carbon, HyperStack, TinyTurla, Kopiluwak, Capibar, Crutch, QUIETCANARY/Tunnus, TwoDash, and MiniPocket. Operation MEDUSA disrupted Snake malware infrastructure in 2023, but later Microsoft reporting shows Secret Blizzard/Turla continuing activity through 2025, including ISP-level adversary-in-the-middle activity against foreign embassies in Moscow.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.