Red October Red October

  • First known sample

    2007

  • Discovery

    2013

  • Number of targets

    100-1000

  • Current status

    Inactive since 2014

  • Type

    Complex cyberattack platform

  • Targeted platforms

    Windows , Windows Mobile

  • TOP targeted countries

    Eastern Europe , Western Europe

  • Connected attacks

    Cloud Atlas

  • The way of propagation

    Exploits , Social engineering

  • Purpose/Functions

    Cyberespionage
  • Special features
    This multi-functional attack platform included several extensions and malicious files designed to quickly adjust to different system configurations and harvest intelligence from infected machines.

  • Targets

    Academia/Research , Aerospace , Diplomatic organizations/embassies , Government entities , Military , Trade and commerce
  • Artefacts/Attribution
    The exploits appear to have been created by Chinese hackers. The Rocra/Red October malware modules have been created by Russian-speaking operatives.
  • Description

    A high-level, cyber-espionage campaign that has successfully infiltrated computer networks at diplomatic, governmental and scientific research organizations in order to gather data and intelligence from mobile devices, computer systems and network equipment. Those targeted are primarily from organizations in Eastern Europe, areas of the former USSR, and Central Asia. Initial infection is through attachments to emails.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com