Western intelligence agencies have disabled the Snake malware network that had been used by Russian FSB spies for more than 20 years.
The tool was successfully dismantled by the FBI, the UK's National Cyber Security Centre (NCSC), part of GCHQ, and cyber agencies in Australia, Canada and New Zealand.
The malware, known as Snake or Uroburos, was discovered operating within government networks, research facilities, and amongst journalists and other targets, according to a joint advisory.
Paul Chichester, the director of operations at the NCSC, said: “The advisory lifts the lid on a highly sophisticated espionage tool used by Russian cyber actors, helping to expose the tactics and techniques being used against specific targets around the world.
“We strongly encourage organisations to read the technical information about Snake malware and implement the mitigations to help detect and defend against this advanced threat.”
American authorities called Snake "the most sophisticated cyber espionage tool in the FSB's arsenal", noting that it was particularly stealthy and extremely hard to detect in computer systems and network traffic.
In at least one case, Snake was placed on the systems of an unnamed Nato country, allowing Russian intelligence to access sensitive international relations documents and diplomatic communications.
Computers in the system served as relay nodes to disguise traffic to and from Snake malware inserted on target computer systems, the US's Cybersecurity and Infrastructure Security Agency said.
Previous official and news reports indicated that Snake and related software has been found on government systems in Germany, Belgium, Ukraine and Switzerland.
In a release, the US Justice Department said the FBI developed a tool known as Perseus, that rendered the Russian malware ineffective.
The FBI was able to defeat Snake by inserting its own bit of computer code into it, which issued commands causing the malware to overwrite itself.
The malware was known to computer security experts for at least a decade, and CISA, the US cyber defence agency, said the FSB began developing it in 2003.
