Snake Campaign: A few words about the Uroburos Rootkit
Summary: Cisco Talos analyzed the Uroburos (Turla/Snake) rootkit dropper, which uses a simple integer-math packer, checks for three mutexes to detect prior instances, and deletes its own files if passed the argument 'up'. On 64-bit systems the dropper loads a signed VirtualBox driver, runs pxinsi64.exe to exploit it via DeviceIoControl IOCTLs, and zeroes the g_ciEnabled variable to disable Driver Signature Enforcement before loading its unsigned driver; on 32-bit systems it loads the driver via ZwLoadDriver, and the technique fails on 64-bit Windows 8 and 8.1.
What's compelling: The rootkit defeats Driver Signature Enforcement on 64-bit Windows 7 by abusing a legitimately signed VirtualBox driver, so a signed-driver requirement alone did not stop this kernel-level implant from loading.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026