FSB CENTER 16·OPERATION MEDUSA

SNAKE // UROBUROS

Educational reconstruction
01 · Modular Implant — Internal System ViewRUNNING · 1x
KERNEL SPACEUSER SPACEOS TCP/IP STACK + HOST FIREWALLPASS · benignNIC / RAW WIREUROBUROS DRIVER · "PURG"NDIS filter · below OS firewall0x2 ENCRYPTED CONTAINERSPAYLOADCONFIG CHANNELSTAGING BUFFERsvchost.exelegitimate processintercepted packetcopy → 0x2
Speed
Telemetry · Stage 01

Snake installs a kernel-mode network filter (public reporting names the driver component 'Purg' within the Uroburos family) that sits below the host's OS firewall. It intercepts raw packets at the NDIS layer, copies and re-injects them, and stores its backdoor payload, configuration channel, and exfil staging buffer inside encrypted virtual file containers tagged 0x2 — invisible to userland tooling.

Educational reconstruction based on public reporting: the joint CISA/ACSC advisory AA23-129A (Hunting RU Intelligence Snake) and U.S. DOJ Operation MEDUSA filings (May 2023). Indicators are representative, not live IOCs.