Malware

Regin malware linked to attacks on cryptographer Belgacom

Pro
Source: IDGNS

25 November 2014

After Symantec blew the lid off Regin on Sunday, computer security experts and companies are revealing information that has lead to suspicions that the US and UK are involved.

Regin has been known about for years by security companies, but Symantec’s white paper on the malware prompted several in the last day to come forward with what they know.

It’s unclear why security companies maintained a collective silence about Regin for so long. Symantec said it first discovered Regin about a year ago and that it took the company that long to analyse it.

Within a day of Symantec’s report, rival Kaspersky Lab had published a 28-page white paper of its own, indicating that the company was well-prepared for when Regin became public.

The Regin platform is considered highly sophisticated due to its use of encryption and modular components, which made it hard for analysts to figure out.

It was used against telecom companies, ISPs, small businesses and individuals, with the aim of collecting login credentials and sensitive data, including infiltrating GSM base stations. Symantec said many of the targets were in Russia and Saudi Arabia.

EU targets

The Intercept reported on Monday that it was Regin which struck the telecommunications company Belgacom and was used against European Union targets. The publication said its conclusion is based on a technical analysis of the malware and sources who investigated those attacks.

Documents leaked by former US National Security Agency contractor Edward Snowden indicated that Belgacom was targeted by the British intelligence agency Government Communications Headquarters (GCHQ) as part of Operation Socialist, according to Der Spiegel.

The Snowden documents revealed many methods of attack and targets of the NSA and GCHQ, which have conducted sophisticated and extensive data collection operations.

NSA spokeswoman Vanee M. Vines wrote via e-mail Monday that the agency would not comment on The Intercept’s “speculation”.

Kaspersky Lab wrote on Monday it obtained a sample of malware that had infected the computer of Jean Jacques Quisquater, a well-known Belgian cryptographer who said his computer was targeted by a sophisticated attack.

Quisquater told IDG News Service in February that investigators from the Belgian Federal Computer Crime Unit (FCCU) told him that the attack against his laptop was directly related to the Belgacom incident.

Read More:


Back to Top ↑

TechCentral.ie