Operation Socialist INVOLVES Regin
Regin was later matched to the malware found on Belgacom during the alleged operation.
Derived Confidence 92% · Jack Rhysider EP 48 Details
“Regin was matched with the malware found on the Belgacom systems”
Malware
malware:regin
Advanced modular malware framework used for espionage and associated in the episode with the Belgacom compromise.
Advanced modular malware framework used for espionage and associated in the episode with the Belgacom compromise.
“Symantec exposed a serious and advanced malware framework they referred to as Regin”
“this malware was installed on the target’s computers which was called Regin”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | Belgacom | Derived | 48 |
| outgoing | TARGETS | European Commission | Explicit | 48 |
| outgoing | TARGETS | European Council | Explicit | 48 |
| outgoing | ASSOCIATED_WITH | Flame | Explicit | 48 |
| outgoing | ASSOCIATED_WITH | Duqu | Explicit | 48 |
| outgoing | AFFECTS | GSM | Explicit | 48 |
| outgoing | AFFECTS | mobile base station | Explicit | 48 |
| outgoing | USES | command and control server | Explicit | 48 |
| outgoing | USES | VPN | Explicit | 48 |
| outgoing | USES | SSL | Explicit | 48 |
| outgoing | USES | Server Message Block | Explicit | 48 |
| outgoing | DISCOVERED_BY | Symantec | Explicit | 48 |
| outgoing | DISCOVERED_BY | Kaspersky | Explicit | 48 |
| incoming | INVOLVES | Operation Socialist | Derived | 48 |
Operation Socialist INVOLVES Regin
Regin was later matched to the malware found on Belgacom during the alleged operation.
Derived Confidence 92% · Jack Rhysider EP 48 Details
“Regin was matched with the malware found on the Belgacom systems”
Regin was used against Belgacom's systems, including systems used by administrators and network infrastructure.
Derived Confidence 95% · Jack Rhysider EP 48 Details
“After the Quantum Insert phishing method was done on Belgacom, then this malware was installed on the target’s computers which was called Regin.”
Regin TARGETS European Commission
Regin was involved in an attack in which the European Commission discovered that it had been hacked.
Explicit Confidence 94% · Jack Rhysider EP 48 Details
“the European Commission discovered it had been hacked”
Regin TARGETS European Council
The episode states that multiple European Council systems were infected in the same attack involving Regin.
Explicit Confidence 93% · Jack Rhysider EP 48 Details
“Multiple systems at the European Commission and European Council were infected”
Researchers found similarities between Regin and Flame, which the episode describes as a spy tool.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Researchers found similarities between Regin and Duqu.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Regin is described as capable of infiltrating GSM systems.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“it has the ability to infiltrate [00:35:00] GSM systems”
Regin AFFECTS mobile base station
The episode equates the GSM systems affected by Regin with mobile base stations and says this could give attackers control over mobile networks.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“GSM systems which are mobile base stations, giving the hackers control over mobile networks”
Regin USES command and control server
Regin uses command-and-control infrastructure to communicate with attackers and transfer collected data.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“the infected systems talk to each other first on the network and then through a central hub which then communicates back to the command servers”
Regin assigns an infected machine a virtual IP address that forms a VPN layer over the network.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“This forms a VPN layer on top of everything else.”
Regin used SSL as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Regin USES Server Message Block
Regin used SMB as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Symantec exposed Regin in a 2014 report.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“In November 2014, Symantec exposed a serious and advanced malware framework they referred to as Regin”
Kaspersky followed Symantec with its own report on Regin and had been tracking it since 2012.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Kaspersky immediately followed up with a report of their own”