Turla__2014__GData_Uroburos_RedPaper_EN_v1.pdf

G Data SecurityLabs analyzes Uroburos, a highly sophisticated rootkit designed to steal data and spy on high-profile targets. Composed of a driver and an encrypted virtual file system with persistence, stealth, and network exfiltration capabilities, it appears tailored for intelligence-gathering against governments, research institutions, and large enterprises, with attributed links to the Agent.BTZ operation and a suspected Russian-origin threat actor. The report notes the malware's modular design and its potential to expand further, though concrete infection vectors remain unknown.