An advanced piece of malware, known as Regin, has been used in systematic spying campaigns against a range of international targets since at least 2008.
This is according to Symantec’s company blog, which reveals that Regin, a back door-type Trojan, is a complex piece of malware whose structure displays a degree of technical competence rarely seen.
Customisable with an extensive range of capabilities depending on the target, it provides its controllers with a powerful framework for mass surveillance and has been used in spying operations against government organisations,
infrastructure operators, businesses, researchers, and private individuals.
As outlined in a technical white paper from Symantec, Backdor.Regin is a multi-staged threat and each stage is hidden and encrypted, with the exception of the first stage. Executing the first stage starts a domino chain of decryption and loading of each subsequent stage for a total of five stages. Each individual stage provides little information on the complete package. Only by acquiring all five stages is it possible to analyse and understand the threat.
Regin also uses a modular approach, allowing it to load custom features tailored to the target, according to Symantec. This modular approach has been seen in other sophisticated malware families such as Flamer and Weevil (The Mask), while the multi-stage loading architecture is similar to that seen in the Duqu/Stuxnet family of threats.
Symantec reveals that Regin infections have been observed in a variety of organisations between 2008 and 2011, after which it was abruptly withdrawn. A new version of the malware resurfaced from 2013 onwards. Targets include private companies, government entities and research institutes.
Almost half of all infections targeted private individuals and small businesses. Attacks on telecoms companies appear to be designed to gain access to calls being routed through their infrastructure.
Infections are also geographically diverse, having been identified in mainly in 10 different countries.
Symantec believes that some targets may be tricked into visiting spoofed versions of well-known Web sites and the threat may be installed through a Web browser or by exploiting an application. On one computer, log files showed that Regin originated from Yahoo! Instant Messenger through an unconfirmed exploit.
Regin’s developers put considerable effort into making it highly inconspicuous, Symantec says. Its low key nature means it can potentially be used in espionage campaigns lasting several years. Even when its presence is detected, it is very difficult to ascertain what it is doing. Symantec was only able to analyse the payloads after it decrypted sample files.
It has several “stealth” features. These include anti-forensics capabilities, a custom-built encrypted virtual file system (EVFS), and alternative encryption in the form of a variant of RC5, which isn’t commonly used. Regin uses multiple sophisticated means to covertly communicate with the attacker including via ICMP/ping, embedding commands in HTTP cookies, and custom TCP and UDP protocols.
