'Red October' has been spying on WORLD LEADERS for 5 years - researchers

New flavour of cyberespionage malware uncovered by security bods


Security watchers have discovered a malware-based cyber-espionage campaign targeting diplomats, governments and scientific research institutions worldwide.

Operation Red October has targeted Eastern Europe, former Soviet republics, and countries in Central Asia for the past five years, according to Kaspersky Lab. The attack has also claimed a smaller number of victims in Western Europe and North America. The firm said attackers are using the malware to slurp data and geopolitical intelligence from the targeted victims' computer systems, mobile phones and enterprise networks.

The malware behind the attack is also designed to steal login credentials, said the researchers, adding that these are sometimes used to gain access to more sensitive systems from compromised machines and networks using stepping-stone tactics.

The Red October malware, dubbed "Rocra", features unique architecture and functionality not seen in previous cyber-espionage attacks, said Kaspersky. Features include an advanced cryptographic spy-module designed to lift data from Acid Cryptofiler, which is known to be used by NATO, the European Union, European Parliament and European Commission since the summer of 2011 to encrypt classified information. The researchers said the malware also has the capability to steal data from smartphones including Android handsets, iPhones and Windows Phone mobes - including Nokia, Sony Ericsson and HTC models.

Kaspersky began investigating the operation after looking into a series of attacks against diplomatic service agencies. Its cyber security experts concluded that the attackers behind the assaults had been active since at least 2007. The firm said that targets have included diplomatic and governmental agencies of various countries across the world, research institutions, energy and nuclear groups, and trade and the aerospace industry.

The Red October attackers designed their own malware, "Rocra", which incorporates a modular architecture featuring malicious extensions, info-stealing modules and backdoor Trojans, said the researchers.

Attackers created more than 60 domain names and several servers, mostly located in Germany and Russia, to act as command and control (C&C) hubs for the attack. These servers act as proxies hiding the location of "mothership" control server, according to the Russian security sleuths.

Kaspersky reckons initial infection was carried out using targeted (spear phishing) malware including a Trojan dropper. Microsoft Office and Microsoft Excel vulnerabilities were exploited to infect targeted systems. The exploits used in the attack were previously used against Tibetan activists as well as military and energy sector targets in Asia. Kaspersky analysts reckon the attackers are native Russian speakers.

"Based on the registration data of C2 servers and the numerous artifacts left in executables of the malware, there is strong technical evidence to indicate the attackers have Russian-speaking origins," Kapserky Lab said in a statement. "In addition, the executables used by the attackers were unknown until recently, and were not identified by Kaspersky Lab’s experts while analysing previous cyber-espionage attacks."

Kaspersky used data from its own protection network as well as information obtained from sink-holing control servers to draw up a list of likely victims. The Russian security firm is continuing to work with international organisations, law enforcement agencies and Computer Emergency Response Teams (CERTs) in investigating the attacks and running a clean-up operation.

More details of the investigation can be found in a blog post by Kaspersky Lab here. ®

Similar topics


Other stories you might like

  • Experts: AI should be recognized as inventors in patent law
    Plus: Police release deepfake of murdered teen in cold case, and more

    In-brief Governments around the world should pass intellectual property laws that grant rights to AI systems, two academics at the University of New South Wales in Australia argued.

    Alexandra George, and Toby Walsh, professors of law and AI, respectively, believe failing to recognize machines as inventors could have long-lasting impacts on economies and societies. 

    "If courts and governments decide that AI-made inventions cannot be patented, the implications could be huge," they wrote in a comment article published in Nature. "Funders and businesses would be less incentivized to pursue useful research using AI inventors when a return on their investment could be limited. Society could miss out on the development of worthwhile and life-saving inventions."

    Continue reading
  • Declassified and released: More secret files on US govt's emergency doomsday powers
    Nuke incoming? Quick break out the plans for rationing, censorship, property seizures, and more

    More papers describing the orders and messages the US President can issue in the event of apocalyptic crises, such as a devastating nuclear attack, have been declassified and released for all to see.

    These government files are part of a larger collection of records that discuss the nature, reach, and use of secret Presidential Emergency Action Documents: these are executive orders, announcements, and statements to Congress that are all ready to sign and send out as soon as a doomsday scenario occurs. PEADs are supposed to give America's commander-in-chief immediate extraordinary powers to overcome extraordinary events.

    PEADs have never been declassified or revealed before. They remain hush-hush, and their exact details are not publicly known.

    Continue reading
  • Stolen university credentials up for sale by Russian crooks, FBI warns
    Forget dark-web souks, thousands of these are already being traded on public bazaars

    Russian crooks are selling network credentials and virtual private network access for a "multitude" of US universities and colleges on criminal marketplaces, according to the FBI.

    According to a warning issued on Thursday, these stolen credentials sell for thousands of dollars on both dark web and public internet forums, and could lead to subsequent cyberattacks against individual employees or the schools themselves.

    "The exposure of usernames and passwords can lead to brute force credential stuffing computer network attacks, whereby attackers attempt logins across various internet sites or exploit them for subsequent cyber attacks as criminal actors take advantage of users recycling the same credentials across multiple accounts, internet sites, and services," the Feds' alert [PDF] said.

    Continue reading

Biting the hand that feeds IT © 1998–2022