Ajay Kumar: Created a new article

2023-09-25T18:45:46Z

Created a new article

New page

{{Short description|Sophisticated malware}}
'''Regin''' (also known as '''Prax''' or '''QWERTY''') is a sophisticated [[malware]] and [[computer hacking|hacking]] toolkit used by United States' [[National Security Agency]] (NSA) and its British counterpart, the [[Government Communications Headquarters]] (GCHQ).<ref name=nsa-und-gchq/><ref>{{cite news |title=Experts Unmask 'Regin' Trojan as NSA Tool |url=http://www.spiegel.de/international/world/regin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html |access-date=9 November 2021 |work=Spiegel.de}}</ref><ref>{{Cite magazine|last=Zetter|first=Kim|title=Researchers Uncover Government Spy Tool Used to Hack Telecoms and Belgian Cryptographer|language=en-US|magazine=Wired|url=https://www.wired.com/2014/11/mysteries-of-the-malware-regin/|access-date=2022-02-22|issn=1059-1028}}</ref> It was first publicly revealed by [[Kaspersky Lab]], [[NortonLifeLock|Symantec]], and [[The Intercept]] in November 2014.<ref name="news">{{cite web|url=http://securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks|title=Regin Revealed|publisher=Kaspersky Lab|access-date=24 November 2014}}</ref><ref name="intercept20041124"/> The malware targets specific users of [[Microsoft Windows]]-based computers and has been linked to the US intelligence-gathering agency [[NSA]] and its British counterpart, the [[GCHQ]].<ref>{{Cite web|url=https://arstechnica.com/tech-policy/2015/10/top-german-official-infected-by-highly-advanced-spy-trojan-with-nsa-ties/|title = Top German official infected by highly advanced spy trojan with NSA ties|date = 26 October 2015}}</ref><ref name="NYT-20141124-NP">{{cite news |last=Perlroth |first=Nicole |title=Symantec Discovers 'Regin' Spy Code Lurking on Computer Networks |url=http://bits.blogs.nytimes.com/2014/11/24/symantec-discovers-spy-code-lurking-on-computer-networks/ |date=24 November 2014 |work=[[New York Times]] |access-date=25 November 2014 }}</ref><ref>{{cite web|url=https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/|title=The Inside Story of How British Spies Hacked Belgium's Largest Telco|publisher=The Intercept|first=Ryan|last=Gallagher|date=13 December 2014}}</ref> ''The Intercept'' provided samples of Regin for download, including malware discovered at a Belgian telecommunications provider, [[Belgacom]].<ref name="intercept20041124"/> Kaspersky Lab says it first became aware of Regin in spring 2012, but some of the earliest samples date from 2003.<ref>[http://www.kaspersky.com/about/news/virus/2014/Regin-a-malicious-platform-capable-of-spying-on-GSM-networks Kaspersky:Regin: a malicious platform capable of spying on GSM networks], 24 November 2014</ref> (The name Regin is first found on the [[VirusTotal]] website on 9 March 2011.<ref name=intercept20041124/>) Among computers infected worldwide by Regin, 28 percent were in [[Russia]], 24 percent in [[Saudi Arabia]], 9 percent each in [[Mexico]] and [[Ireland]], and 5 percent in each of [[India]], [[Afghanistan]], [[Iran]], [[Belgium]], [[Austria]], and [[Pakistan]].<ref name="symantecblog">{{cite web|url=http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance|title=Regin: Top-tier espionage tool enables stealthy surveillance|publisher=Symantec|access-date=25 November 2014|date=23 November 2014}}</ref>

[[Kaspersky Lab|Kaspersky]] has said the malware's main victims are private individuals, small businesses and [[Telecommunications service provider|telecom companies]]. Regin has been compared to [[Stuxnet]] and is thought to have been developed by "well-resourced teams of developers", possibly a [[Western culture|Western]] government, as a targeted multi-purpose data collection tool.<ref name="bbc">{{cite news|url=https://www.bbc.com/news/technology-30171614|title=BBC News - Regin, new computer spying bug, discovered by Symantec|work=BBC News|date=23 November 2014|access-date=23 November 2014}}</ref><ref name="whitepapers">{{cite web|url=http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf|title=Regin White Paper|publisher=Symantec|access-date=23 November 2014|archive-date=7 September 2019|archive-url=https://web.archive.org/web/20190907005119/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf|url-status=dead}}</ref><ref name="whitepaperk">{{cite web|url=https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf|title=Regin White Paper|publisher=Kaspersky Lab|access-date=24 November 2014}}</ref>

According to ''[[Die Welt]]'', security experts at [[Microsoft]] gave it the name "Regin" in 2011, after the cunning Norse dwarf [[Regin]].<ref>{{cite news|author1=Benedikt Fuest|title=Ein Computervirus, so mächtig wie keines zuvor|url=https://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html|newspaper=Die Welt|date=24 November 2014|archive-url=https://web.archive.org/web/20141128080847/http://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html|archive-date=28 November 2014}}</ref>

==Operation==
Regin uses a modular approach allowing it to load features that exactly fit the target, enabling customized spying. The design makes it highly suited for persistent, long-term mass surveillance operations against targets.<ref>{{cite web|url=http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/|title=Regin Malware - 'State-Sponsored' Spying Tool Targeted Govts|work=The Hacking Post - Latest hacking News & Security Updates|access-date=2014-11-24|archive-date=2017-02-18|archive-url=https://web.archive.org/web/20170218064037/http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/|url-status=dead}}</ref><ref name="scmagazine">{{cite web|url=http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/|title=NSA, GCHQ or both behind Stuxnet-like Regin malware?|publisher=scmagazineuk.com|access-date=25 November 2014|date=24 November 2014}}</ref>

Regin is stealthy and does not store multiple files on the infected system; instead it uses its own encrypted [[virtual file system]] (EVFS) entirely contained within what looks like a single file with an innocuous name to the host, within which files are identified only by a numeric code, not a name. The EVFS employs a variant encryption of the rarely used [[RC5 cipher]].<ref name="scmagazine" /> Regin communicates over the Internet using [[Internet Control Message Protocol|ICMP]]/[[Ping (networking utility)|ping]], commands embedded in [[HTTP cookies]] and custom [[Transmission Control Protocol|TCP]] and [[User Datagram Protocol|UDP]] protocols with a [[command and control server]] which can control operations, upload additional [[Payload (computing)|payloads]], etc.<ref name="symantecblog" /><ref name="whitepapers"/>

===Identification and naming===
Symantec says that both it and Kaspersky identified the malware as ''Backdoor.Regin''.<ref name="symantecblog" /> Most antivirus programs, including Kaspersky, (as of October 2015) do NOT identify the sample of Regin released by The Intercept as malware.<ref>[https://www.virustotal.com/en/file/4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be/analysis/ Virustotal: Detection ratio: 21 / 56 ]</ref> On 9 March 2011 Microsoft added related entries to its Malware Encyclopedia;<ref>[http://www.microsoft.com/security/portal/mmpc/default.aspx Microsoft Malware Protection Center, click button "Malware Encyclopedia]</ref><ref>[http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3AWinNT%2FRegin.A#tab=1 Microsoft Protection Center: Trojan:WinNT/Regin.A]</ref> later two more variants, ''Regin.B'' and ''Regin.C'' were added. Microsoft appears to call the 64-bit variants of Regin ''Prax.A'' and ''Prax.B''. The Microsoft entries do not have any technical information.<ref name=intercept20041124/> Both Kaspersky and Symantec have published [[white paper]]s with information they learned about the malware.<ref name="whitepapers"/><ref name="whitepaperk"/>

==Known attacks and originator of malware==
German news magazine ''[[Der Spiegel]]'' reported in June 2013 that the US [[intelligence]] [[National Security Agency]] (NSA) had conducted online surveillance on both [[European Union]] (EU) citizens and EU institutions. The information derives from [[Global surveillance disclosures (2013–present)|secret documents obtained]] by former NSA worker [[Edward Snowden]]. Both ''Der Spiegel'' and ''[[The Intercept]]'' quote a secret 2010 NSA document stating that it made [[Cyber-attack|cyberattacks]] that year, without specifying the malware used, against the EU diplomatic representations in [[Washington, D.C.]] and its representations to the [[United Nations]].<ref name="intercept20041124" /><ref name="spiegel">{{cite web|url=http://www.spiegel.de/international/europe/nsa-spied-on-european-union-offices-a-908590.html|title=Attacks from America: NSA Spied on European Union Offices|first1=Laura|last1=Poitras|first2=Marcel|last2=Rosenbach|first3=Fidelius |last3=Schmid|first4=Holger|last4=Stark|publisher=Der Spiegel|date=29 June 2013}}</ref> Signs identifying the software used as Regin were found by investigators on infected machines.

''The Intercept'' reported that, in 2013, the UK's [[GCHQ]] attacked [[Belgacom]], Belgium's largest telecommunications company.<ref name=intercept20041124>{{cite web|url=https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/|first1=Morgan|last1=Marquis-Boire|first2=Claudio|last2=Guarnieri|first3=Ryan|last3=Gallagher|title=Secret Malware in European Union Attack Linked to U.S. and British Intelligence|publisher=The Intercept|date=24 November 2014}}</ref> These attacks may have led to Regin coming to the attention of security companies. Based on analysis done by IT security firm Fox IT, ''Der Spiegel'' reported in November 2014, that Regin is a tool of the UK and USA intelligence agencies. Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the [[NSA ANT catalog]] under the names "Straitbizarre" and "Unitedrake". Fox IT did not name the customer, but ''Der Spiegel'' mentioned that among the customers of Fox IT is Belgacom and cited the head of Fox IT, Ronald Prins, who stated that they are not allowed to speak about what they found in the Belgacom network.<ref name=nsa-und-gchq>[http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein-werkzeug-von-nsa-und-gchq-a-1004950.html Christian Stöcker, Marcel Rosenbach " Spionage-Software: Super-Trojaner Regin ist eine NSA-Geheimwaffe" Der Spiegel, November 25, 2014]</ref>

In December 2014, German newspaper ''[[Bild]]'' reported that Regin was found on a [[USB flash drive]] used by a staff member of Chancellor [[Angela Merkel]]. Checks of all high-security laptops in the [[German Chancellery]] revealed no additional infections.<ref>{{cite news |url=http://www.dw.de/german-government-denies-falling-victim-to-cyber-attack/a-18158951 |title=German government denies falling victim to cyber attack |newspaper=Deutsche Welle |date=29 December 2014 }}</ref>

Regin was used in October and November 2018 to hack the research and development unit of [[Yandex]].<ref name="MoscowTimes">{{cite news |url=https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |title=Western Intelligence Hacked 'Russia's Google' Yandex to Spy on Accounts |agency=Reuters |date=June 27, 2019 |archive-url=https://web.archive.org/web/20190629085027/https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194 |archive-date=June 29, 2019}}</ref>

==See also==
* [[Advanced persistent threat]]
* [[Cyberwarfare in the United States]]
* [[NSA ANT catalog]]
* [[Stuxnet]]
* [[WARRIOR PRIDE]]

==References==
{{reflist|30em|}}
[[Category:Rootkits]]
[[Category:Computer access control]]
[[Category:Privilege escalation exploits]]
[[Category:Cryptographic attacks]]
[[Category:Exploit-based worms]]
[[Category:2014 in computing]]
[[Category:Hacking in the 2010s]]
[[Category:Spyware used by governments]]
[[Category:Cybercrime in India]]

Regin (malware) - Revision history

Ajay Kumar: Created a new article