Cyber Sleuths Find 'Smoking Gun' Linking British Spy Agency to Regin Malware - Mashable
Mashable, By Lorenzo Franceschi-Bicchierai
Ever since the sophisticated and unprecedented cyberattack platform called "Regin" was uncovered in November, cyber sleuths have been working hard to put together all the pieces of this complicated puzzle.
Regin was like a dinosaur: many researchers found some of its bones throughout the years, but no one had the full skeleton, as a researcher put it at the time. Now, thanks to newly published Edward Snowden documents, some researchers might have found the smoking gun that conclusively connects the dinosaur to a specific spy agency, the British Government Communications Headquarters (GCHQ), a close ally of the National Security Agency (NSA).
Less than two weeks ago, Der Spiegel published a new trove of Snowden documents, exposing a series of previously unknown cyberweapons at the disposal of spies from the so-called "Five Eyes," the five countries that have a special relationship and share intelligence information with each other (U.S., UK, Australia, New Zealand, Canada).
Among the documents, the German magazine also released the code belonging to a type of malware called QWERTY, designed to monitor the keystrokes on a victim's computer.
When Kaspersky Lab researcher Costin Raiu saw the code, he immediately spotted a pattern and thought: "that's a Regin plugin!" Read more.
