Uroburos — Malware Profile
Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.
MITRE ATT&CK techniques (36)
- T1001.001 Junk Data
- T1001.003 Protocol or Service Impersonation
- T1005 Data from Local System
- T1008 Fallback Channels
- T1012 Query Registry
- T1014 Rootkit
- T1027.002 Software Packing
- T1027.009 Embedded Payloads
- T1027.011 Fileless Storage
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1055.001 Dynamic-link Library Injection
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090.003 Multi-hop Proxy
- T1095 Non-Application Layer Protocol
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1132.002 Non-Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1205 Traffic Signaling
- T1543.003 Windows Service
- T1559 Inter-Process Communication
- T1564.005 Hidden File System
- T1572 Protocol Tunneling
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1620 Reflective Code Loading