What We Know About 'Regin,' the Powerful Malware That Could Be the Work of NSA - Mashable

Mashable, By Lorenzo Franceschi-Bicchierai

For many years, a sophisticated and unprecedented cyberespionage campaign known as "Regin" has been targeting hundreds of computers and networks in dozens of countries around the world. Yet its existence has only been unearthed in the last couple of days.

This is likely not your run-of-the-mill cyberattack mounted by criminals trying to steal credit card numbers, or by spies looking for intellectual property and trade secrets. According to several security researchers who have been investigating it and published reports on Sunday and Monday, this is the sophisticated work of hackers who dabble as government agents.

Security researchers at Symantec have called Regin "peerless" and "groundbreaking," and it might be the most advanced malware campaign ever uncovered, a peek into the future of espionage and surveillance.

Like Stuxnet, the cyberattack that crippled Iran's nuclear program in the late 2000s, this campaign was most likely conducted by hackers working for a government with significant resources and some are already pointing their fingers at the United States and the UK and, more specifically, the NSA and its British counterpart, the GCHQ.

What is Regin?

Regin is a tool capable of infecting and compromising entire networks, not just individual computers, as security companies Symantec and Kaspersky Labs detailed in their technical reports published on Sunday and Monday.

It's not only a computer virus or malware, but also a toolkit or platform that can be used for different purposes, depending on the needs of the attackers. It can collect passwords, retrieve deleted files, and even take over entire networks and infrastructures, according to researchers.

It's a toolkit that is made of various pieces, and that unfolds in five different stages, making it extremely hard to detect. In one of its stages, Regin disguises itself as legitimate Microsoft software to fool targets and avoid detection. (Microsoft declined to comment when Mashable asked if the company had any knowledge of Regin.) Read more.