Hacking Team RCS Hacking Team RCS

  • First known sample

    2008

  • Discovery

    2011

  • Number of targets

    100-1000

  • Current status

    Active

  • Type

    Backdoor , Bootkit , Rootkit , Trojan

  • Targeted platforms

    Android , BlackBerry , OS X , Windows , Windows Mobile , iOS

  • TOP targeted countries

    CIS , Germany , India , Iraq , Italy , Mexico , Russia , Turkey , Ukraine , Vietnam

  • The way of propagation

    Bootable CD-ROM , Direct hard disk infection , Exploits , Mobile infections through already infected PCs , Social engineering , USB cables , Unknown

  • Purpose/Functions

    Surveillance
  • Special features
    “Business-to-government” spyware

  • Targets

    Activists , Criminal suspects , Journalists , Politicians
  • Artefacts/Attribution
    This program was developed by the Italian company HackingTeam and is intended for sale to government authorities in different countries.
  • Description

    A spyware program developed by the Italian company known as HackingTeam. It is a self-replicating malicious program designed to steal personal data and transmit it to a remote server. Initial infection occurs through an email with a link to a file or an email with the malware in the attachment. Its victims are worldwide.

    Additional information

© 2023 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com