Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    Complex Regin Cyber-Spy Malware Steals Data, Leaves Little Evidence

    Written by

    Robert Lemos
    Published November 25, 2014
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Online spies using an espionage platform, known as Regin, have had significant success at infiltrating systems in Russia, Saudi Arabia and other countries, without leaving much trace, according to antivirus firms.

      Since at least 2008, and perhaps as early as 2003, unknown adversaries have used the Regin platform to create multi-stage malware attacks that have compromised systems and stolen data from telecommunications firms, government officials, multinational agencies, financial and research institutions, and individuals. Antivirus firms used superlatives to describe the platform and its ability to create sophisticated and customized malware to conduct whatever types of operations are necessary.

      “Regin is an extremely complex piece of software that can be customized with a wide range of different capabilities which can be deployed depending on the target,” Symantec stated in a report published on Nov. 23. “Its stealth combines many of the most advanced techniques that we have ever seen in use.”

      Regin is not a specific piece of malware, or a campaign targeting a group of common targets, but a “”platform, which researchers have not seen, to create malware for specific attacks or operations. The malware used in those operations left behind evidence that security researchers used to piece together information about the platform that created them.

      The modularity of the code is one advanced technique that made investigations more difficult. Different modules were used to attack each target and were delivered in five stages with all five stages encrypted using a single key. Because different operations used different keys, investigators had to hope to find all five stages on the same system or find systems that had been infected with malware using the same key, Liam O’Murchu, senior development manager for security response at Symantec, told eWEEK.

      “It did thwart things quite a bit, not because the encryption was difficult to get by but because you have to recover all these stages at the same time in order to decrypt them,” he said. “The key changes from version to version and from sample to sample.”

      Symantec first began investigating malware connected to the Regin platform in the fall of 2013. The company was not the first. Russian antivirus firm Kaspersky Lab became aware of the attack tool in the spring of 2012 while F-Secure claims it had researched the attack since 2009.

      The Regin platform stores code in encrypted virtual file systems to better hide the information from security software. The platform also creates malware that can monitor the GSM networks used by cellular phones.

      “In today’s world, we have become too dependent on mobile phone networks, which rely on ancient communication protocols with little or no security available for the end user,” Kaspersky Lab stated in its analysis. “Although all GSM networks have mechanisms embedded which allow entities such as law enforcement to track suspects, there are other parties which can gain this ability and further abuse them to launch other types of attacks against mobile users.”

      The sophistication of its techniques puts Regin in the same category, if not above, the likes of Stuxnet, Flame and Snake/Turla, three of the most advanced threats seen to date, according to security firm F-Secure.

      “As always, attribution is difficult with cases like this,” F-Secure stated. “Our belief is that this malware, for a change, isn’t coming from Russia or China.”

      Robert Lemos
      Robert Lemos
      Robert Lemos is an award-winning journalist who has covered information security, cybercrime and technology's impact on society for almost two decades. A former research engineer, he's written for Ars Technica, CNET, eWEEK, MIT Technology Review, Threatpost and ZDNet. He won the prestigious Sigma Delta Chi award from the Society of Professional Journalists in 2003 for his coverage of the Blaster worm and its impact, and the SANS Institute's Top Cybersecurity Journalists in 2010 and 2014.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×