Regin Regin

  • First known sample

    2003

  • Discovery

    2012

  • Number of targets

    1-100

  • Current status

    Active

  • Type

    Complex cyberattack platform , Rootkit , Trojan

  • Targeted platforms

    Windows

  • TOP targeted countries

    Afghanistan , Algeria , Belgium , Brazil , Fiji , Germany , India , Indonesia , Iran , Kiribati , Malaysia , Pakistan , Russia , Syria

  • The way of propagation

    USB drives

  • Purpose/Functions

    Cyberespionage , Facilitating other types of attacks , Remote control
  • Special features
    Regin – the first cyber-attack platform known to penetrate and monitor GSM networks in addition to other “standard” spying tasks.

  • Targets

    Academia/Research , Financial institutions , Government entities , Multi-national political bodies , Specific individuals , Telecoms
  • Artefacts/Attribution
    Considering the complexity and cost of Regin development, it is likely that this operation is supported by a nation-state.
  • Description

    A malware toolkit designed primarily for the purposes of intelligence gathering that’s been facilitating attacks since 2012. The initial infection method is still unknown, but once inside, the cyber-attack platform is deployed for ultimate remote control at all levels. Victims are primarily representatives of the government, political bodies, research institutions, and financial organizations from the Middle East and Europe.

    Additional information

© 2024 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com