Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
Viruses & Malware
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Kaspersky Labs Discovers
Kaspersky Labs Discovers 'Red October' Malware Spy Ring

By Barry Levine
January 14, 2013 1:55PM

Bookmark and Share
The leading number of Red October infections discovered -- 35 -- is in the Russian Federation, suggesting Red October is not run by the Russian government. In fact, Kaspersky Labs said although Red October is gathering "classified information and geopolitical intelligence," there is "no evidence linking this with a nation-state sponsored attack."
 


It sounds like a remake of the Tom Clancy novel by the same name, but "Red October" is the name of an advanced cyber espionage network that is targeting governments and other organizations around the world. The network was discovered by the security firm Kaspersky Labs, which announced its findings Monday.

The firm said its researchers have spent several months analyzing malware from the organization, which, since at least 2007, targets organizations primarily in central Asia and in Eastern European countries that were formerly in the Soviet Union, as well as ones in Western Europe and North America.

Hiding the 'True Mothership'

Kaspersky said the attackers have conducted these operations for at least five years, and stolen data, such as security credentials, are reused in later attacks. More than five dozen domain names have been created to control the network of infected machines, utilizing hosting locations in Germany, Russia and other countries.

Targets have included embassies and other diplomatic and governmental locations, research institutions, trade and commerce organizations, nuclear and energy research, oil and gas companies, aerospace and military. Hundreds of infections have been located worldwide.

The firm said that the actual command-and-control infrastructure is a chain of proxy servers that hide the location of the "true mothership command and control server." The network is designed to allow an attacker to recover access to infected machines through other communication channels, if need be. A "resurrection" function enables a malware module to be reinstalled, even if it's been removed.

Red October, which is also called Rocra for short, is designed to steal data from mobile devices, enterprise network equipment, already-deleted files recovered from removable disk drives, e-mail databases from Outlook or POP/IMAP servers, or local FTP servers, in addition to workstations.

'Russian-Speaking Origins'

The observed attacks exploited vulnerabilities in Excel or Word, and, against Tibetan activists and Asia-based military and energy targets, used spear-phishing attacks. Spear phishing is fraudulent e-mail that appears to originate from someone within an organization, and attempts to trick the recipient into revealing confidential data or clicking on a link.

Because of registration data in the command-and-control servers and clues left in executables, Kaspersky, whose world headquarters are in Moscow, said it "strongly" believes the attackers "have Russian-speaking origins." The network was dubbed Red October by Kaspersky because of the use of the Russian language in the code.

Interestingly, the leading number of infections discovered -- 35 -- is in the Russian Federation, suggesting that this operation is not run by the Russian government. In fact, Kaspersky said that there is "no evidence linking this with a nation-state sponsored attack." The main purpose of the attacks appears to be gathering "classified information and geopolitical intelligence," although the use is unknown.

While the malware has been developed by Russian-speaking programmers, the exploits themselves appear to have been handled by Chinese hackers.

The company said it first investigated the Rocra attacks in October of last year at the request of an unnamed "partner," who chooses to remain anonymous. Kaspersky regularly unveils its investigations into major malware attacks, including the Flame virus that apparently attacked computers in Iran. There is no apparent connection between Flame and Red October, the security firm said.
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Viruses & Malware
1.   Big DDoS Attacks Hit Record in 2014
2.   Google Hacker Team to Hunt Bugs
3.   Russian Hacker's Charges Revealed
4.   Hackers Target Western Energy Firms
5.   Android SMS Worm on the Loose


advertisement
Android SMS Worm on the Loose
Malware lets bad actors cash in.
Average Rating:
Big DDoS Attacks Hit Record in 2014
Attackers often use NTP reflection.
Average Rating:
Hackers Target Western Energy Firms
Appears to be state-sponsored group.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Mobile Technology Spotlight
Nvidia Revamps Shield as an Android Game Tablet
Going after hardcore PC gamers, Nvidia is releasing a gaming-focused tablet that works with a controller. The Shield Tablet follows the Shield Portable gaming handheld Nvidia released last year.
 
Apple Patent for Smart Watch Comes to Light
Does a new smart watch patent issued to Apple provide a preview of the expected wearable from the tech giant? Some Apple-watchers are parsing the patent for signs of the coming product.
 
Will iPhone 6 Cannibalize Apple's Tablet Sales?
Could Apple’s iPhone 6 -- it’s so-called super-size phone due to hit store shelves this fall -- come back to haunt the smartphone maker? Some observers say yes; others say preposterous.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.