Red October specializes in espionage

[Детектив-Юг]

Red October specializes in espionage
[DLMURL] https://www.osp.ru/news/2013/0115/13016864/ [/ DLMURL]
Kaspersky Lab has discovered a spy network, the organizers of which monitor diplomatic, governmental and scientific organizations in various countries. This was said in a statement.

The actions of the attackers were aimed at obtaining confidential information, data that open access to computer systems, personal mobile devices and corporate networks, as well as collecting information of a geopolitical nature. The attackers made the main emphasis on the republics of the former USSR, the countries of Eastern Europe, and also a number of states in Central Asia.

Kaspersky Lab experts found that the operation, codenamed Red October, began back in 2007 and continues to this day. The main goal of cybercriminals has become diplomatic and government structures around the world. However, among the victims there are also research institutes, companies involved in energy issues, including nuclear, space agencies, as well as trading enterprises. The creators of Red October have developed their own malicious code that has a unique modular architecture, consisting of malicious extensions, modules designed to steal information. To control the network of infected machines, cybercriminals used more than 60 domain names and servers located in different countries. At the same time, a significant part of them were located in Germany and Russia.

 

[Детектив-Юг]

[DLMURL] https://www.kaspersky.ru/news?id=207733920 [/ DLMURL]

Kaspersky Lab has published a report on a study of a large-scale campaign conducted by cybercriminals to spy on diplomatic, government and scientific organizations in different countries of the world. The actions of the attackers were aimed at obtaining confidential information, data that open access to computer systems, personal mobile devices and corporate networks, as well as collecting information of a geopolitical nature. The attackers made the main emphasis on the republics of the former USSR, the countries of Eastern Europe, and also a number of states in Central Asia.

In October 2012, Kaspersky Lab experts launched an investigation into a series of attacks on computer networks of international diplomatic missions. In the process of studying these incidents, experts discovered a large-scale cyber spy network. Based on the results of its analysis, Kaspersky Lab experts concluded that the operation, codenamed Red October, began back in 2007 and continues to this day.

The main goal of cybercriminals has become diplomatic and government structures around the world. However, among the victims there are also research institutes, companies involved in energy issues, including nuclear, space agencies, as well as trading enterprises. The creators of Red October have developed their own malware, which has a unique modular architecture, consisting of malicious extensions, modules designed to steal information. In the antivirus database of Kaspersky Lab, this malware is called Backdoor.Win32.Sputnik.

To control the network of infected machines, cybercriminals used more than 60 domain names and servers located in different countries of the world. At the same time, a significant part of them were located in Germany and Russia. Analysis of the management server infrastructure by Kaspersky Lab experts showed that the attackers used a whole chain of proxy servers to hide the location of the main management server.

Criminals stole information contained in files of various formats from infected systems. Among others, experts found acid * files that indicate they belong to the secret Acid Cryptofiler software, which is used by a number of organizations within the European Union and NATO.

To infect systems, criminals sent phishing emails addressed to specific recipients in a particular organization. The letter included a special Trojan, for the installation of which the letters contained exploits that exploited vulnerabilities in Microsoft Office. These exploits were created by third-party attackers and were previously used in various cyber attacks aimed at both Tibetan activists and the military and energy sectors of several states in the Asian region.

To determine the victims of cyber espionage, Kaspersky Lab experts analyzed data obtained from two main sources: the cloud service Kaspersky Security Network (KSN) and sinkhole servers designed to monitor infected machines that communicate with command servers.
KSN statistics helped to identify several hundred unique infected computers, most of which belonged to embassies, consulates, government organizations and research institutes. A significant part of the infected systems was detected in Eastern Europe.
The sinkhole server data was received from November 2, 2012 to January 10, 2013. During this time, more than 55,000 connections from 250 infected IP addresses registered in 39 countries were recorded. Most connections made from infected IP addresses were reported in Switzerland, Kazakhstan, and Greece.

Cybercriminals created a multi-functional platform for attacks, containing dozens of extensions and malicious files that can quickly adapt to different system configurations and collect sensitive data from infected computers.

The most noteworthy characteristics of malware components are:
A recovery module that allows criminals to “resurrect” infected machines. The module is embedded as a plug-in in Adobe Reader and Microsoft Office and provides attackers with repeated access to the system if the main malicious program was detected and deleted or if a system update occurred.
Advanced cryptographic spy modules designed to steal information, including from various cryptographic systems, for example, from Acid Cryptofiler, which has been used since 2011 to protect information in organizations such as NATO, the European Union, the European Parliament and the European Commission.
Possibility of infection of mobile devices: In addition to infecting traditional workstations, this malware can steal data from mobile devices, in particular smartphones (iPhone, Nokia and Windows Phone). Also, attackers could steal configuration information from industrial network equipment (routers, switching devices) and even remote files from external USB drives.

The registration data of the command servers and the information contained in the executable files of the malware give every reason to assume that the cybercriminals have Russian-speaking roots.

Kaspersky Lab, together with international organizations, law enforcement agencies and national Computer Emergency Response Teams (CERT), continues to investigate the operation, providing technical expertise and resources to inform and conduct measures to treat infected systems.

More information is available at [DLMURL] https://www.securelist.com/en/ [/ DLMURL].

 

[Частный детектив Самара.]

This is not comm intelligence: D

 

[Плотников Юрий Михайлович]

Thanks, interesting!

 

[Андрей Захаров]

Thanks Victor)))

 

[Арсен]

Thank!

 

[Марат]

Thank!

 

[Турабян Владимир]

THANK!

 

[Роберт]

Still would. Kaspersky at one time graduated from the Faculty of Mathematics of the Higher School of KGB. F. E Deerzhinsky
, the so-called "binomials": D
This is his specialty: D

 

[Детектив-Юг]

This is his specialty: D

Create and fight successfully?
This is abruptly KR.