Venomous Bear

Venomous Bear, also known as Turla, Urobouros, Snake, and other names, is a threat actor group attributed to Center 16 of the Federal Security Service (FSB) of the Russian Federation. The group has been active since at least 2004, targeting diplomatic and government organizations, as well as private businesses in various regions including the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. Their activities have included cyberespionage and the deployment of ransomware, with notable incidents such as a damaging hack of Germany’s Foreign Ministry in 2017. Recently, Venomous Bear has focused its efforts on the Information Technology industry, specifically targeting Dragos. They have utilized a malware known as "Snake" or "Urobouros," which was identified in a search of information associated with computers constituting the Snake Malware Network. In addition to this, they have also employed a novel backdoor in their attacks named "TinyTurla-NG," which has been used against several non-governmental organizations across Poland between December and late January. Despite the long-standing attribution of certain campaigns to Venomous Bear, recent research suggests that some operations previously connected to the group were actually conducted by an entirely separate entity named "Tomiris." This revelation underscores the complexity and evolving nature of the threat landscape. Moreover, it highlights the need for continuous vigilance and the development of robust cybersecurity strategies to mitigate the risks posed by these sophisticated threat actors.