| Regin | |
|---|---|
| Malware details | |
| Aliases | Prax, QWERTY |
| Authors | NSA,GCHQ |
| Technical details | |
| Platform | Windows |
Regin (also known asPrax orQWERTY) is a sophisticatedmalware andhacking toolkit used by United States'National Security Agency (NSA) and its British counterpart, theGovernment Communications Headquarters (GCHQ).[1][2][3] It was first publicly revealed byKaspersky Lab,Symantec, andThe Intercept in November 2014.[4][5] The malware targets specific users ofMicrosoft Windows-based computers and has been linked to the US intelligence-gathering agencyNSA and its British counterpart, theGCHQ.[6][7][8]The Intercept provided samples of Regin for download, including malware discovered at a Belgian telecommunications provider,Belgacom.[5] Kaspersky Lab says it first became aware of Regin in spring 2012, but some of the earliest samples date from 2003.[9] (The name Regin is first found on theVirusTotal website on 9 March 2011.[5]) Among computers infected worldwide by Regin, 28 percent were inRussia, 24 percent inSaudi Arabia, 9 percent each inMexico andIreland, and 5 percent in each ofIndia,Afghanistan,Iran,Belgium,Austria, andPakistan.[10]
Kaspersky has said the malware's main victims are private individuals, small businesses andtelecom companies. Regin has been compared toStuxnet and is thought to have been developed by "well-resourced teams of developers", possibly aWestern government, as a targeted multi-purpose data collection tool.[11][12][13]
According toDie Welt, security experts atMicrosoft gave it the name "Regin" in 2011, after the cunning Norse dwarfRegin.[14]
Regin uses a modular approach allowing it to load features that exactly fit the target, enabling customized spying. The design makes it highly suited for persistent, long-termmass surveillance operations against targets.[15][16]
Regin is stealthy and does not store multiple files on the infected system; instead it uses its own encryptedvirtual file system (EVFS) entirely contained within what looks like a single file with an innocuous name to the host, within which files are identified only by a numeric code, not a name. The EVFS employs a variant encryption of the rarely usedRC5 cipher.[16] Regin communicates over the Internet usingICMP/ping, commands embedded inHTTP cookies and customTCP andUDP protocols with acommand and control server which can control operations, upload additionalpayloads, etc.[10][12]
Symantec says that both it and Kaspersky identified the malware asBackdoor.Regin.[10] Most antivirus programs, including Kaspersky, (as of October 2015) do NOT identify the sample of Regin released by The Intercept as malware.[17] On 9 March 2011 Microsoft added related entries to its Malware Encyclopedia;[18][19] later two more variants,Regin.B andRegin.C were added. Microsoft appears to call the 64-bit variants of ReginPrax.A andPrax.B. The Microsoft entries do not have any technical information.[5] Both Kaspersky and Symantec have publishedwhite papers with information they learned about the malware.[12][13]
German news magazineDer Spiegel reported in June 2013 that the USintelligenceNational Security Agency (NSA) had conducted online surveillance on bothEuropean Union (EU) citizens and EU institutions. The information derives fromsecret documents obtained by former NSA workerEdward Snowden. BothDer Spiegel andThe Intercept quote a secret 2010 NSA document stating that it madecyberattacks that year, without specifying the malware used, against the EU diplomatic representations inWashington, D.C. and its representations to theUnited Nations.[5][20] Signs identifying the software used as Regin were found by investigators on infected machines.
The Intercept reported that, in 2013, the UK'sGCHQ attackedBelgacom, Belgium's largest telecommunications company.[5] These attacks may have led to Regin coming to the attention of security companies. Based on analysis done by IT security firm Fox IT,Der Spiegel reported in November 2014, that Regin is a tool of the UK and USA intelligence agencies. Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in theNSA ANT catalog under the names "Straitbizarre" and "Unitedrake". Fox IT did not name the customer, butDer Spiegel mentioned that among the customers of Fox IT is Belgacom and cited the head of Fox IT, Ronald Prins, who stated that they are not allowed to speak about what they found in the Belgacom network.[1]
In December 2014, German newspaperBild reported that Regin was found on aUSB flash drive used by a staff member of ChancellorAngela Merkel. Checks of all high-security laptops in theGerman Chancellery revealed no additional infections.[21]
Regin was used in October and November 2018 to hack the research and development unit ofYandex.[22]