Red October (malware) - Revision history

Ankushraj: small fix

2026-03-15T23:32:12Z

small fix

Ajay Kumar: Created a new article

2023-09-25T18:45:36Z

Created a new article

New page

{{short description|Cyberespionage malware}}
'''Operation Red October''' or '''Red October''' was a [[cyberespionage]] [[malware]] [[Computer program|program]] discovered in October 2012 and uncovered in January 2013 by Russian firm [[Kaspersky Lab]]. The malware was reportedly operating worldwide for up to five years prior to discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices.
The primary vectors used to install the malware were emails containing attached documents that exploited vulnerabilities in [[Microsoft Word]] and [[Microsoft Excel|Excel]].<ref name=McAllister>{{cite news | first = Neil | last = McAllister | publisher = [[The Register]] | title = Surprised? Old Java exploit helped spread Red October spyware | url = https://www.theregister.co.uk/2013/01/16/red_october_java_connection | date = 16 Jan 2013}}</ref><ref>{{cite news | publisher = [[Kaspersky Lab]] | title = The "Red October" Campaign – An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies | url = https://www.securelist.com/en/blog/785/The_Red_October_Campaign_An_Advanced_Cyber_Espionage_Network_Targeting_Diplomatic_and_Government_Agencies | date = 3 Mar 2014}}</ref>
Later, a webpage was found that exploited a known vulnerability in the Java browser plugin.<ref name=McAllister /><ref>{{cite news | first = Dan | last = Goodin | publisher = [[Ars Technica]] | title = Red October relied on Java exploit to infect PCs | url = https://arstechnica.com/security/2013/01/massive-espionage-malware-relied-on-java-exploit-to-infect-pcs | date = 15 Jan 2013}}</ref>
Red October was termed an advanced cyberespionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.

A [https://s3.eu-central-1.amazonaws.com/euobs-media/97b802870897fd63703ecd3497e43286.png map] of the extent of the operation was released by the [[Kaspersky Lab]] – the "Moscow-based antivirus firm that uncovered the campaign."<ref name="wired"/>

After being revealed, domain registrars and hosting companies shut down as many as 60 domains, used by the virus creators to receive information. The attackers, themselves, shut down their end of the operation, as well. {{Citation needed|date=August 2016}}

The perpetrator of the operation has not been conclusively determined but it appeared to have been in operation on some level since May 2007 at the latest. According to Kaspersky Lab, Russian slang words were found in the code which would be "generally unknown to non-native Russian speakers." However, the program also appeared to be built on existing exploits developed by Chinese [[hackers]] and previously used against [[Tibetan independence movement|Tibetan activists]].<ref name="wired">{{cite news |last1=Zetter |first1=Kim |title=Cybersleuths Uncover 5-Year Spy Operation Targeting Governments, Others |url=https://www.wired.com/2013/01/red-october-spy-campaign/ |access-date=25 January 2023 |work=[[Wired (magazine)|Wired]] |date=January 14, 2013}}</ref>

{| class="wikitable sortable"
|+ Operation Red October Cyber Breaches<ref name="wired"/>
|-
! Country !! Government !! Embassy (Diplomatic) !! Military !! Nuclear / Energy Research !! Aerospace !! Oil & Gas Industry !! Trade and Commerce !! Research Institutions!! Unknown Victims
|-
| {{flag| United States}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Russia}} || No || Yes || Yes || Yes || No || No || No || Yes || No
|-
| {{flag| Belarus}} || Yes || Yes || Yes || Yes || No || Yes || No || Yes || No
|-
| {{flag| Kazakhstan}} || Yes || Yes || Yes || Yes || Yes || No || No || No || No
|-
| {{flag| United Arab Emirates}} || Yes || Yes || No || Yes || No || Yes || No || No || No
|-
| {{flag| Azerbaijan}} || No || Yes || No || Yes || No || Yes || No || Yes || No
|-
| {{flag| Turkmenistan}} || Yes || No || No || Yes || No || Yes || No || No || No
|-
| {{flag| Afghanistan}} || Yes || Yes || Yes || No || No || No || No || No || No
|-
| {{flag| Moldova}} || Yes || Yes || Yes || No || No || No || No || No || No
|-
| {{flag| France}} || No || Yes || Yes || No || No || No || No || No || No
|-
| {{flag| Spain}} || Yes || Yes || No || No || No || No || No || No || No
|-
| {{flag| Armenia}} || Yes || Yes || No || No || No || No || No || No || No
|-
| {{flag| Cyprus}} || Yes || Yes || No || No || No || No || No || No || No
|-
| {{flag| Iraq}} || Yes || No || No || No || No || No || No || No || No
|-
| {{flag| Brunei}} || Yes || No || No || No || No || No || No || No || No
|-
| {{flag| Luxembourg}} || Yes || No || No || No || No || No || No || No || No
|-
| {{flag| India}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Uganda}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Pakistan}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Oman}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Saudi Arabia}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Italy}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Portugal}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Morocco}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Israel}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Jordan}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Greece}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Ireland}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Belgium}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Germany}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Hungary}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Mauritania}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Congo}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| South Africa}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Botswana}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Mozambique}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Tanzania}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Kenya}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Lithuania}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Latvia}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Turkey}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Iran}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Uzbekistan}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Kuwait}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Switzerland}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Lebanon}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Austria}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Georgia (country)|name=Georgia}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Bosnia & Herzegovina}} || No || Yes || No || No || No || No || No || No || No
|-
| {{flag| Serbia}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Finland}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Czech Republic}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Slovakia}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Macedonia}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Albania}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Mali}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Australia}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Chile}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Brazil}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Ethiopia}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Bulgaria}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Bahrain}} || No || No || No || No || No || No || No || No || Yes
|-
| {{flag| Slovakia}} || No || No || No || No || No || No || No || No || Yes
|}

== References ==
{{reflist}}

== External links ==
* [http://www.kaspersky.com/about/news/virus/2013/Kaspersky_Lab_Identifies_Operation_Red_October_an_Advanced_Cyber_Espionage_Campaign_Targeting_Diplomatic_and_Government_Institutions_Worldwide Info at kaspersky.com]

{{Hacking in the 2010s}}

[[Category:Spyware]]
[[Category:Hacking in the 2010s]]
[[Category:Espionage in Russia]]
[[Category:Cybercrime in India]]

← Older revision		Revision as of 05:02, 16 March 2026
Line 1:		Line 1:
	{{short description\|Cyberespionage malware}}		{{short description\|Cyberespionage malware}}
	'''Operation Red October''' or '''Red October''' was a [[cyberespionage]] [[malware]] [[Computer program\|program]] discovered in October 2012 and uncovered in January 2013 by Russian firm [[Kaspersky Lab]]. The malware was reportedly operating worldwide for up to five years prior to discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices.		'''Operation Red October''' or '''Red October''' was a [[cyberespionage]] [[malware]] [[Computer program\|program]] discovered in October 2012 and uncovered in January 2013 by Russian firm [[Kaspersky Lab]]. The malware was reportedly operating worldwide for up to five years prior to discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices.
	The primary vectors used to install the malware were emails containing attached documents that exploited vulnerabilities in [[Microsoft Word]] and [[Microsoft Excel\|Excel]].<ref name=McAllister>{{cite news \| first = Neil \| last = McAllister \| publisher = [[The Register]] \| title = Surprised? Old Java exploit helped spread Red October spyware \| url = https://www.theregister.co.uk/2013/01/16/red_october_java_connection \| date = 16 Jan 2013}}</ref><ref>{{cite news \| publisher = [[Kaspersky Lab]] \| title = The "Red October" Campaign – An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies \| url = https://www.securelist.com/en/blog/785/The_Red_October_Campaign_An_Advanced_Cyber_Espionage_Network_Targeting_Diplomatic_and_Government_Agencies \| date = 3 Mar 2014}}</ref>		The primary vectors used to install the malware were emails containing attached documents that exploited vulnerabilities in [[Microsoft Word]] and [[Microsoft Excel\|Excel]].<ref name=McAllister>{{cite news \| first = Neil \| last = McAllister \| publisher = [[The Register]] \| title = Surprised? Old Java exploit helped spread Red October spyware \| url = https://www.theregister.co.uk/2013/01/16/red_october_java_connection \| date = 16 Jan 2013}}</ref><ref>{{cite news \| publisher = [[Kaspersky Lab]] \| title = The "Red October" Campaign – An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies \| url = https://www.securelist.com/en/blog/785/The_Red_October_Campaign_An_Advanced_Cyber_Espionage_Network_Targeting_Diplomatic_and_Government_Agencies \| date = 3 Mar 2014\|archive-url=https://web.archive.org/web/20130115005904/https://www.securelist.com/en/blog/785/The_Red_October_Campaign_An_Advanced_Cyber_Espionage_Network_Targeting_Diplomatic_and_Government_Agencies\|archive-date=2013-01-15\|url-status=dead}}</ref>
	Later, a webpage was found that exploited a known vulnerability in the Java browser plugin.<ref name=McAllister /><ref>{{cite news \| first = Dan \| last = Goodin \| publisher = [[Ars Technica]] \| title = Red October relied on Java exploit to infect PCs \| url = https://arstechnica.com/security/2013/01/massive-espionage-malware-relied-on-java-exploit-to-infect-pcs \| date = 15 Jan 2013}}</ref>		Later, a webpage was found that exploited a known vulnerability in the Java browser plugin.<ref name=McAllister /><ref>{{cite news \| first = Dan \| last = Goodin \| publisher = [[Ars Technica]] \| title = Red October relied on Java exploit to infect PCs \| url = https://arstechnica.com/security/2013/01/massive-espionage-malware-relied-on-java-exploit-to-infect-pcs \| date = 15 Jan 2013}}</ref>
	Red October was termed an advanced cyberespionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.		Red October was termed an advanced cyberespionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.
Line 7:		Line 7:
	A [https://s3.eu-central-1.amazonaws.com/euobs-media/97b802870897fd63703ecd3497e43286.png map] of the extent of the operation was released by the [[Kaspersky Lab]] – the "Moscow-based antivirus firm that uncovered the campaign."<ref name="wired"/>		A [https://s3.eu-central-1.amazonaws.com/euobs-media/97b802870897fd63703ecd3497e43286.png map] of the extent of the operation was released by the [[Kaspersky Lab]] – the "Moscow-based antivirus firm that uncovered the campaign."<ref name="wired"/>

	After being revealed, domain registrars and hosting companies shut down as many as 60 domains, used by the virus creators to receive information. The attackers, themselves, shut down their end of the operation, as well. {{Citation needed\|date=August 2016}}		After being revealed, domain registrars and hosting companies shut down as many as 60 domains, used by the virus creators to receive information. The attackers, themselves, shut down their end of the operation, as well.{{Citation needed\|date=August 2016}}

	The perpetrator of the operation has not been conclusively determined but it appeared to have been in operation on some level since May 2007 at the latest. According to Kaspersky Lab, Russian slang words were found in the code which would be "generally unknown to non-native Russian speakers." However, the program also appeared to be built on existing exploits developed by Chinese [[hackers]] and previously used against [[Tibetan independence movement\|Tibetan activists]].<ref name="wired">{{cite ~~news~~ \|last1=Zetter \|first1=Kim \|title=Cybersleuths Uncover 5-Year Spy Operation Targeting Governments, Others \|url=https://www.wired.com/2013/01/red-october-spy-campaign/ \|access-date=25 January 2023 \|~~work~~=[[Wired (magazine)\|Wired]] \|date=January 14, 2013}}</ref>		The perpetrator of the operation has not been conclusively determined but it appeared to have been in operation on some level since May 2007 at the latest. According to Kaspersky Lab, Russian slang words were found in the code which would be "generally unknown to non-native Russian speakers." However, the program also appeared to be built on existing exploits developed by Chinese [[hackers]] and previously used against [[Tibetan independence movement\|Tibetan activists]].<ref name="wired">{{cite magazine \|last1=Zetter \|first1=Kim \|title=Cybersleuths Uncover 5-Year Spy Operation Targeting Governments, Others \|url=https://www.wired.com/2013/01/red-october-spy-campaign/ \|access-date=25 January 2023 \|magazine=[[Wired (magazine)\|Wired]] \|date=January 14, 2013}}</ref>

	{\| class="wikitable sortable"		{\| class="wikitable sortable"
Line 155:		Line 155:
	[[Category:Espionage in Russia]]		[[Category:Espionage in Russia]]
	[[Category:Cybercrime in India]]		[[Category:Cybercrime in India]]
			[[Category:2012 in computing]]