Regin (malware)

Regin uses a modular approach allowing it to load features that exactly fit the target, enabling customized spying. The design makes it highly suited for persistent, long-term mass surveillance operations against targets.{{cite web|url=http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/|title=Regin Malware - 'State-Sponsored' Spying Tool Targeted Govts|work=The Hacking Post - Latest hacking News & Security Updates|access-date=2014-11-24|archive-date=2017-02-18|archive-url=https://web.archive.org/web/20170218064037/http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/|url-status=dead}}{{cite web|url=http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/|title=NSA, GCHQ or both behind Stuxnet-like Regin malware?|work=SC Magazine UK |publisher=scmagazineuk.com|access-date=25 November 2014|date=24 November 2014}}

Regin is stealthy and does not store multiple files on the infected system; instead it uses its own encrypted virtual file system (EVFS) entirely contained within what looks like a single file with an innocuous name to the host, within which files are identified only by a numeric code, not a name. The EVFS employs a variant encryption of the rarely used RC5 cipher. Regin communicates over the Internet using ICMP/ping, commands embedded in HTTP cookies and custom TCP and UDP protocols with a command and control server which can control operations, upload additional payloads, etc.

Symantec says that both it and Kaspersky identified the malware as Backdoor.Regin. Most antivirus programs, including Kaspersky, (as of October 2015) do NOT identify the sample of Regin released by The Intercept as malware.[https://www.virustotal.com/en/file/4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be/analysis/ Virustotal: Detection ratio: 21 / 56 ] On 9 March 2011 Microsoft added related entries to its Malware Encyclopedia;[http://www.microsoft.com/security/portal/mmpc/default.aspx Microsoft Malware Protection Center, click button "Malware Encyclopedia][http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3AWinNT%2FRegin.A#tab=1 Microsoft Protection Center: Trojan:WinNT/Regin.A] later two more variants, Regin.B and Regin.C were added. Microsoft appears to call the 64-bit variants of Regin Prax.A and Prax.B. The Microsoft entries do not have any technical information. Both Kaspersky and Symantec have published white papers with information they learned about the malware.

German news magazine Der Spiegel reported in June 2013 that the US intelligence National Security Agency (NSA) had conducted online surveillance on both European Union (EU) citizens and EU institutions. The information derives from secret documents obtained by former NSA worker Edward Snowden. Both Der Spiegel and The Intercept quote a secret 2010 NSA document stating that it made cyberattacks that year, without specifying the malware used, against the EU diplomatic representations in Washington, D.C. and its representations to the United Nations.{{cite web|url=http://www.spiegel.de/international/europe/nsa-spied-on-european-union-offices-a-908590.html|title=Attacks from America: NSA Spied on European Union Offices|first1=Laura|last1=Poitras|first2=Marcel|last2=Rosenbach|first3=Fidelius |last3=Schmid|first4=Holger|last4=Stark|publisher=Der Spiegel|date=29 June 2013}} Signs identifying the software used as Regin were found by investigators on infected machines.

The Intercept reported that, in 2013, the UK's GCHQ attacked Belgacom, Belgium's largest telecommunications company.{{cite news|url=https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/|first1=Morgan|last1=Marquis-Boire|first2=Claudio|last2=Guarnieri|first3=Ryan|last3=Gallagher|title=Secret Malware in European Union Attack Linked to U.S. and British Intelligence|work=The Intercept |publisher=The Intercept|date=24 November 2014}} These attacks may have led to Regin coming to the attention of security companies. Based on analysis done by IT security firm Fox IT, Der Spiegel reported in November 2014, that Regin is a tool of the UK and USA intelligence agencies. Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the NSA ANT catalog under the names "Straitbizarre" and "Unitedrake". Fox IT did not name the customer, but Der Spiegel mentioned that among the customers of Fox IT is Belgacom and cited the head of Fox IT, Ronald Prins, who stated that they are not allowed to speak about what they found in the Belgacom network.[http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein-werkzeug-von-nsa-und-gchq-a-1004950.html Christian Stöcker, Marcel Rosenbach " Spionage-Software: Super-Trojaner Regin ist eine NSA-Geheimwaffe" Der Spiegel, November 25, 2014]

In December 2014, German newspaper Bild reported that Regin was found on a USB flash drive used by a staff member of Chancellor Angela Merkel. Checks of all high-security laptops in the German Chancellery revealed no additional infections.{{cite news |url=http://www.dw.de/german-government-denies-falling-victim-to-cyber-attack/a-18158951 |title=German government denies falling victim to cyber attack |newspaper=Deutsche Welle |date=29 December 2014 }}

Regin was used in October and November 2018 to hack the research and development unit of Yandex.{{cite news |url=https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |title=Western Intelligence Hacked 'Russia's Google' Yandex to Spy on Accounts |agency=Reuters |date=June 27, 2019 |archive-url=https://web.archive.org/web/20190629085027/https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |archive-date=June 29, 2019}}

• Advanced persistent threat
• Cyberwarfare in the United States
• NSA ANT catalog
• Stuxnet
• WARRIOR PRIDE

{{reflist|30em|}}

Category:Rootkits

Category:Computer access control

Category:Privilege escalation exploits

Category:Cryptographic attacks

Category:Exploit-based worms

Category:2014 in computing

Category:Hacking in the 2010s

Category:Spyware used by governments

Category:Cybercrime in India