The FBI says it has disrupted a long-running malware operation that allowed Russian spies to steal sensitive information from several countries, including NASA member governments, prominent journalists and other targets deemed of interest to the Russian government .
The court-authorized operation, codenamed MEDUSA, disrupted a global peer-to-peer network of computers compromised by sophisticated malware called “Snake,” described by the U.S. Department of Justice (DoJ) as the “first cyberespionage malware” of Russia’s Federal Security Service ( FSB). Officials said the malware was knocked offline earlier this week.
The hacking group, a well-known entity known as Turla, spent nearly two decades using different versions of the Snake malware to steal sensitive documents from hundreds of computer systems in at least 50 countries.
According to the DoJ, the Snake malware recorded keystrokes, which hackers used to steal target account authentication information such as usernames and passwords. It warned victims that stolen credentials could still be used to fraudulently access compromised computers and other accounts.
The FBI was able to decrypt and decode Snake communications through analysis of the Snake malware and its network.
“Using information gathered from monitoring the Snake network and analyzing the Snake malware, the FBI developed a tool called PERSEUS, which establishes communication sessions with the Snake malware implant on a specific computer and issues commands that cause the Snake implant to deactivate even without affecting the host computer or legitimate applications on the computer,” it DoJ explained in a publication.
Russia officially denies conducting cyberespionage operations, but the FBI and its partners are in no doubt about the significance of its breakthrough.
Commenting on the FBI’s work, Attorney General Merrick B. Garland said, “We will continue to strengthen our collective defenses against the Russian regime’s destabilizing efforts to undermine the security of the United States and our allies.”