- Aug 3, 2013
- 1,879
Symantec described the malware as having five stages, each “hidden and encrypted, with the exception of the first stage”.
An advanced malicious software application has been uncovered that since 2008 was used to spy on private companies, governments, research institutes and individuals in 10 countries, antivirus-software-maker Symantec Corp said in a report on Sunday.
While Symantec did not identify any culprit or victims, the California-based maker of Norton antivirus products said its research pointed to a “nation state” being the likely developer of malware Regin, or Backdoor.Regin.
Symantec said Regin’s design “makes it highly suited for persistent, long-term surveillance operations against targets”, and was withdrawn in 2011 but resurfaced from 2013 onward. The malware uses several “stealth features and even when its presence is detected, it is very difficult to ascertain what it is doing,” according to Symantec. It said “many components of Regin remain undiscovered and additional functionality and versions may exist.”
Almost half of all infections occurred at addresses of Internet service providers, the report said. It said the targets were customers of the companies rather than the companies themselves.
About 28 percent of targets were in the telecom sector while other victims were in energy, airline, hospitality and research, Symantec said.
Five stages
Symantec described the malware as having five stages, each “hidden and encrypted, with the exception of the first stage”.
“Each individual stage provides little information on the complete package. Only by acquiring all five stages is it possible to analyse and understand the threat,” it said.
Regin also uses a “modular approach” that allows it to load custom features tailored for targets — the same method is applied in other malware such as Flamer and Weevil (The Mask), the antivirus company said. Some of its features were also similar to the malware Duqu, which was uncovered in September 2011 and related to a computer worm discovered the previous year called Stuxnet.
Cybersecurity is a sensitive topic for businesses in the United States, where there have been several breaches of information among major companies and customers.
The U.S. government and private cyber intelligence firms have said they suspect state-backed hackers in China or Russia may be responsible.
SOURCE
