November 24, 2014
An advanced malicious software application has been uncovered that since 2008 was used to spy on private companies, governments, research institutes and individuals in 10 countries, anti-virus software maker Symantec Corp said in a report on Sunday.
The Mountain View, California-based maker of Norton anti-virus products said its research showed that a
"nation state" was likely the developer of the malware called Regin, or Backdoor. Regin, but Symantec did not identify any countries or victims.
Symantec described the malware as having five stages, each "hidden and encrypted, with the exception of the first stage." It said "each individual stage provides little information on the complete package. Only by acquiring all five stages is it possible to analyze and understand the threat."
Regin infections have been observed in a variety of organizations between 2008 and 2011, after which it was abruptly withdrawn.
A new version of the malware resurfaced from 2013 onwards. Targets include private companies, government entities and research institutes. Almost half of all infections targeted private individuals and small businesses. Attacks on telecoms companies appear to be designed to gain access to calls being routed through their infrastructure.
Figure 1. Confirmed Regin infections by sector Infections are also geographically diverse, having been identified mainly in ten different countries.
Figure 2. Confirmed Regin Infections by Country
Regin also uses what is called a modular approach that allows it to load custom features tailored to targets, the same method applied in other malware, such as Flamer and Weevil (The Mask), the anti virus company said. Some of its features were also similar to Duqu malware, uncovered in September 2011 and related to a computer worm called Stuxnet, discovered the previous year.
Full technical details are available on the attached document, and full details on “Regin” spyware can be found on:
http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance