Regin worm

2018: Attack on "Yandex"

On June 27, 2019 the western investigation cracked "Yandex" to spy on accounts. The company confirmed the attacks, but assured that data of users managed to be saved.

According to Reuters with reference to informed sources, from October to November, 2018 the hackers working for intelligence agencies intruded in computer systems of "Yandex" and implemented rare type of the malware under the name Regin. This virus is used by prospecting alliance Five Eyes which includes intelligence agencies of the USA, Great Britain, Australia, New Zealand and Canada. However to define what of five states stood behind an attack on "Yandex", it is impossible, interlocutors of the agency reported. Read more here.

2014: Detection of a virus

Specialists of anti-virus company Symantec in the fall of 2014 detected the Backdoor.Regin virus intended for theft of confidential data at government institutions, utility companies, the commercial organizations, research centers and individuals. Authors of a virus "showed the level of technical training which can seldom be met"^[1].

The attacks using the Regin virus were carried out in the different countries regularly to the period from 2008 to 2011 what statistics collected by Symantec from the infected systems confirms. In 2011 the virus suddenly was gone, but in 2013 developed again.

Generally the virus attacks individuals and small business — is the share of them about 50% of all attacks. Also the attacks are directed on telecom operators, for the purpose of gaining access to phone calls in their networks.

The greatest number of the attacks of the Regin virus is recorded in the Russian Federation (28%) and Saudi Arabia (24%). Smaller number — in Mexico (9%), Ireland (9%), India (5%), Afghanistan (5%), Iran (5%), Belgium (5%), Austria (5%) and Pakistan (5%).

The standard functionality of Regin includes: capture of screenshots, receiving control over the mouse cursor, theft of passwords, monitoring of network traffic and recovery of remote files. However, depending on type of the purpose and tasks, hackers can select and connect add-on modules to Regin. In total their several tens.

One of such modules is intended for monitoring of web traffic on servers running the software of Microsoft, another — for interception of traffic in networks of telecommunication companies.

"Troyan provides to hackers powerful tools for mass observation and was used for espionage in authorities, utility companies the commercial organizations, research centers and concerning individuals" — reported in Symantec.

Infection with the Regin virus occurs after the victim visits a harmful web-link. In one case the virus got on the computer through vulnerability in the Yahoo! Instant Messenger application.

It is remarkable that Regin is supplied with high degree of protection. All its modules are ciphered, and the non-standard encryption algorithm is used. The virus can be detected on the computer, but what he is engaged in, to find out extremely difficult, told in Symantec.

Specialists assume that development of the malware took many months or even years. According to them, for Regin definitely there is a state as only it has that volume of resources which is necessary for creation of a virus of similar level of complexity. The company does not make the assumptions, the program was developed where exactly.

Regin is the multi-stage attack. Each stage, except the first, is ciphered. Each stage in itself does not give an idea of the general attack. The complete picture arises only when you have all five stages.

The attacks were performed during the period from 2008 to 2011 (Regin 1.0) then malware disappeared. They emerged in 2013 (Regin 2.0) with some considerable differences: the new version 64-bit, and, perhaps, lost one stage.

Symantec did not find stage 3 in version 2.0 that it is possible to explain with the fact that in the 1st version, the 3rd stage concerns device driver, and secret installation of drivers of devices in 64-bit Windows is complex business even for sophisticated hackers.

The description of Backdoor.Trojan.GR shows in the database of threats of Symantec that it was detected and protection is provided since December 12, 2013. Presumably, they did not know that the threat existed much longer, and the retrospective analysis showed its true nature and use in the previous years.

Nevertheless, is a lot unclear for researchers of Regin. For example, the reproduced infection vector is not defined, and it can be configured for the specific attacks.

There are also "tens of options of payload of Regin" providing a set of normal things: theft of the password, image capture of the screen, theft of files (including remote files) and many other things.

The malware uses non-standard and strange methods to remain imperceptible. For example, it has own built-in ciphered virtual file system. Symantec considers that many Regin components remain unsolved.

Based on complexity of threat and considerable investments which it requires it is difficult not to agree with Symantec that it is similar to the instrument of the state espionage. The diagram of Symantec of spread of infections over the country also shows an atypical situation.

See Also

Notes