The cyber weapon has been increasingly used since the start of this year, even before protests that led to the overthrow of president Viktor Yanukovych, British-based BAE Systems said in a report published Friday.
The complex composition of Snake bears similarities with Stuxnet, the malware that disrupted Iran’s nuclear facilities in 2010.
Snake — also known as Ouroboros after the serpent in Greek mythology — gives remote attackers “full remote access to the compromised system”, BAE said.
Because it can stay inactive for a number of days, it is extremely hard to detect.
Although its origins are unclear, its developers appear to operate it in the same timezone as Moscow — GMT plus four hours — and some Russian text is embedded into the code, BAE says.