Skip to main content
Darkfield

Operator dossier

snake (also tracked as Turla, VENOMOUS Bear, Group 88, Waterbug) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 3 public victims claimed by this operator between May 4, 2020 and June 7, 2020. The Snake ransomware group is a relatively obscure threat actor that emerged in May 2020 with a financially motivated agenda, having conducted a limited number of documented attacks with only three known victims to date. The group's origin and affiliations remain largely unknown, with insufficient public documentation from major security firms or law enforcement agencies to determine their country of origin, operational structure, or potential connections to other cybercriminal organizations. Based on limited available data, Snake appears to target critical infrastructure sectors including Critical Manufacturing, Healthcare and Public Health, and Energy, with observed activity spanning Argentina and Germany, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented by reputable security researchers. Due to the group's limited operational footprint and lack of high-profile campaigns or major incidents reported by CISA, FBI, or established threat intelligence firms, there are no notable campaigns or significant ransoms on record that would warrant detailed analysis. The current operational status of the Snake ransomware group remains unclear given the sparse public intelligence available about their activities beyond the initial observation period.

Suspected origin: RU (community attribution, not authoritative).

Most-targeted sectors

Most-affected countries

Recent disclosures by snake

All 3 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for snake →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

snake

aka Turla, VENOMOUS Bear, Group 88, Waterbug, WRAITH, Uroburos, Pfinet, TAG_0530, KRYPTON, Hippo Team, Pacifier APT, Popeye, SIG23, IRON HUNTER, MAKERSMARK, ATK13, G0010, ITG12, Blue Python, SUMMIT, UNC4210, Secret Blizzard, UAC-0144, UAC-0024, UAC-0003 · 3 victims indexed · first seen 6 years ago · last activity 6 years ago

3
Victims indexed
#280 of 364 tracked operators
1m
Active period
May 2020 → Jun 2020
2
Countries hit
top AR · 1

At a glance

Status
inactive
Aliases
Turla, VENOMOUS Bear, Group 88, Waterbug, WRAITH, Uroburos, Pfinet, TAG_0530, KRYPTON, Hippo Team, Pacifier APT, Popeye, SIG23, IRON HUNTER, MAKERSMARK, ATK13, G0010, ITG12, Blue Python, SUMMIT, UNC4210, Secret Blizzard, UAC-0144, UAC-0024, UAC-0003
First seen
6 years ago
Last activity
6 years ago
Primary sector
Critical Manufacturing · 1 hits
Suspected origin
🇷🇺RU

Attribution

Community-assessed by the MISP threat-intel community — not Darkfield's own attribution.

Suspected sponsor
Russian Federation
Activity type
Espionage
Attribution confidence
Moderate · 50/100

About

The Snake ransomware group is a relatively obscure threat actor that emerged in May 2020 with a financially motivated agenda, having conducted a limited number of documented attacks with only three known victims to date. The group's origin and affiliations remain largely unknown, with insufficient public documentation from major security firms or law enforcement agencies to determine their country of origin, operational structure, or potential connections to other cybercriminal organizations. Based on limited available data, Snake appears to target critical infrastructure sectors including Critical Manufacturing, Healthcare and Public Health, and Energy, with observed activity spanning Argentina and Germany, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented by reputable security researchers. Due to the group's limited operational footprint and lack of high-profile campaigns or major incidents reported by CISA, FBI, or established threat intelligence firms, there are no notable campaigns or significant ransoms on record that would warrant detailed analysis. The current operational status of the Snake ransomware group remains unclear given the sparse public intelligence available about their activities beyond the initial observation period.

References

37 links

External sources curated by the MISP threat-intel community.

Timeline

2 months
2020-05-01T00:00:00+00:00 · 12020-06-01T00:00:00+00:00 · 2
2020-05-01T00:00:00+00:002020-06-01T00:00:00+00:00

Top countries

🇦🇷 Argentina
1
🇩🇪 Germany
1
Argentina dossier →Germany dossier →

Top sectors

Critical Manufacturing
1
Healthcare and Public Health
1
Energy
1
Critical Manufacturing dossier →Healthcare and Public Health dossier →Energy dossier →

MITRE ATT&CK

68 techniques · 13 tactics

Tactics

CollectionCommand And ControlCredential AccessDefense ImpairmentDiscoveryExecutionExfiltrationInitial AccessLateral MovementPersistencePrivilege EscalationResource DevelopmentStealth

Techniques

Recent victims

Loading…

Source

Updated 6 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time snake posts a victim.

Add snake to your watchlist — Pro pings you within 5 minutes of any new snake leak-site post, Telegram callout, or affiliate-rebrand inference.