It sounds like a remake of the Tom Clancy novel by the same name, but "Red October" is the name of an advanced cyber espionage network that is targeting governments and other organizations around the world. The network was discovered by the security firm Kaspersky Labs, which announced its findings Monday.
The firm said its researchers have spent several months analyzing malware from the organization, which, since at least 2007, targets organizations primarily in central Asia and in Eastern European countries that were formerly in the Soviet Union, as well as ones in Western Europe and North America.
Hiding the 'True Mothership'
Kaspersky said the attackers have conducted these operations for at least five years, and stolen data , such as security credentials, are reused in later attacks. More than five dozen domain names have been created to control the network of infected machines, utilizing hosting locations in Germany, Russia and other countries.
Targets have included embassies and other diplomatic and governmental locations, research institutions, trade and commerce organizations, nuclear and energy research, oil and gas companies, aerospace and military. Hundreds of infections have been located worldwide.
The firm said that the actual command-and-control infrastructure is a chain of proxy servers that hide the location of the "true mothership command and control server ." The network is designed to allow an attacker to recover access to infected machines through other communication channels, if need be. A "resurrection" function enables a malware module to be reinstalled, even if it's been removed.
Red October, which is also called Rocra for short, is designed to steal data from mobile devices, enterprise network equipment, already-deleted files recovered from removable disk drives, e-mail databases from Outlook or POP/IMAP servers, or local FTP servers, in addition to workstations.
The observed attacks exploited vulnerabilities in Excel or Word, and, against Tibetan activists and Asia-based military and energy targets, used spear-phishing attacks. Spear phishing is fraudulent e-mail that appears to originate from someone within an organization, and attempts to trick the recipient into revealing confidential data or clicking on a link. (continued...)