acid rain
BANNED
- Joined
- Nov 10, 2012
- Messages
- 4,688
- Reaction score
- -10
- Country
- Location
Trojan is likely state sponsored, has attacked Russian, Saudi internet providers and telecoms since 2008
Security researchers have discovered one of the most advanced pieces of malware ever created — and it's been in use since at least 2008. Symantec researchers published their findings today on a new Trojan they're calling "Regin."
The researchers say the tool is "a complex piece of malware whose structure displays a degree of technical competence rarely seen." It's been cleverly designed to spy on computer systems around the world while leaving hardly a trace behind. The software's "authors have gone to great lengths to cover its tracks," reports Symantec, by using multiple layers of complex encryption to mask spying activities. Even when Symantec's researchers did discover the presence of malware on clients' machines, they had to decrypt an entire sample package of files just to get some idea of what the tool was up to.
The espionage tool has been found primarily on systems in Russia and Saudi Arabia, though it's presence has been detected in smaller numbers in Mexico, Ireland, India, Afghanistan, Iran, Belgium, Austria, and Pakistan. Over half of all confirmed cases were on machines in Russia and Saudi Arabia.
Attacks on internet providers and telecom companies — with the goal of obtaining information from the small businesses and individuals that use their services — accounted for roughly 75 percent of infections. Airlines, energy utilities, research agencies, and hospitality companies were also targets of such attacks.
As you might expect, something this complex isn't designed to steal your credit card numbers. The sophistication of the software, and its confirmed targets, according to Symantec, makes almost certain that the malware is state-sponsored. In fact, the researchers say that it is similar to the Stuxnet worm that was allegedly designed sabotage Iran's nuclear program. They should know: this group of computer security experts are the same team that first discovered Stuxnet. The US, Israel, and China are believed to be among the nations with the funding and expertise to develop and execute such attacks.
Whichever nation state sponsored this malware, it's believed that Regin is likely that government's primary means of executing cyber espionage around the world. One of the malware's fairly unique traits is that it is highly customizable. Different packages can be built into the payload that infects computer systems. Some of the typical tools the software has at its disposal is the ability to remotely control the mouse and keyboard, take screenshots, record key presses and network activity, and recover deleted files. But spies could also load more specialized functionality designed for specific monitoring of energy utility or telecom systems, according to researchers. Those custom payloads "exhibit a high degree of expertise in specialist sectors," according to researchers — another sign that a large state player is behind the software.
Security researchers have discovered one of the most advanced pieces of malware ever created — and it's been in use since at least 2008. Symantec researchers published their findings today on a new Trojan they're calling "Regin."
The researchers say the tool is "a complex piece of malware whose structure displays a degree of technical competence rarely seen." It's been cleverly designed to spy on computer systems around the world while leaving hardly a trace behind. The software's "authors have gone to great lengths to cover its tracks," reports Symantec, by using multiple layers of complex encryption to mask spying activities. Even when Symantec's researchers did discover the presence of malware on clients' machines, they had to decrypt an entire sample package of files just to get some idea of what the tool was up to.
The espionage tool has been found primarily on systems in Russia and Saudi Arabia, though it's presence has been detected in smaller numbers in Mexico, Ireland, India, Afghanistan, Iran, Belgium, Austria, and Pakistan. Over half of all confirmed cases were on machines in Russia and Saudi Arabia.
Attacks on internet providers and telecom companies — with the goal of obtaining information from the small businesses and individuals that use their services — accounted for roughly 75 percent of infections. Airlines, energy utilities, research agencies, and hospitality companies were also targets of such attacks.
As you might expect, something this complex isn't designed to steal your credit card numbers. The sophistication of the software, and its confirmed targets, according to Symantec, makes almost certain that the malware is state-sponsored. In fact, the researchers say that it is similar to the Stuxnet worm that was allegedly designed sabotage Iran's nuclear program. They should know: this group of computer security experts are the same team that first discovered Stuxnet. The US, Israel, and China are believed to be among the nations with the funding and expertise to develop and execute such attacks.
Whichever nation state sponsored this malware, it's believed that Regin is likely that government's primary means of executing cyber espionage around the world. One of the malware's fairly unique traits is that it is highly customizable. Different packages can be built into the payload that infects computer systems. Some of the typical tools the software has at its disposal is the ability to remotely control the mouse and keyboard, take screenshots, record key presses and network activity, and recover deleted files. But spies could also load more specialized functionality designed for specific monitoring of energy utility or telecom systems, according to researchers. Those custom payloads "exhibit a high degree of expertise in specialist sectors," according to researchers — another sign that a large state player is behind the software.
