Operation “Medusa”: US neutralizes Russian spy software

The US Justice Department says it has broken up a Russian cyber-espionage operation that has been stealing sensitive data from computers in the US and other NATO countries for years. The hackers used different versions of the infamous “Snake” malware.

The researchers attribute this to a unit of the Russian domestic secret service FSB called “Turla”. Hundreds of computer systems in at least 50 countries have been attacked in this way over a period of 20 years, according to a statement from the ministry on Tuesday (local time).

In collaboration with several foreign governments, the US Federal Police (FBI) and the US Prosecutor’s Office succeeded in neutralizing this software that had been smuggled onto computer networks under the code name “Medusa”. A program developed by the FBI (“Perseus”) was used for this. This caused the “Snake” malware to overwrite itself and thus deactivate.

“For 20 years, the FSB has relied on Snake malware to conduct cyber espionage against the United States and our allies — today it ends,” said Assistant Attorney General Matthew Olsen, chief of the Justice Department’s National Security Division. “We will continue to strengthen our collective defense against the Russian regime’s destabilizing attempts to undermine the security of the United States and our allies,” said Attorney General Merrick Garland.

US authorities have been investigating “Snake” software and related programs for nearly 20 years, the statement said. The US government observed FSB officers from the Turla unit in Russia. The unit has been constantly updating and revising the malware to ensure it remains their most advanced hacking software. For victims of the attacks outside the US, the FBI is working with local authorities to notify them of Snake infections in their countries. (aeg/sda/dpa)