GCHQ/NSA Data-Grabbing Malware Disguised Itself As Microsoft Drivers, Was Served Via Fake LinkedIn Pages

Privacy

from the im-in-ur-internet-stealing-ur-files dept

Some nasty malware with a decade of history behind it has been uncovered and it has the fingerprints of two governments all over it.

Complex malware known as Regin is the suspected technology behind sophisticated cyberattacks conducted by U.S. and British intelligence agencies on the European Union and a Belgian telecommunications company, according to security industry sources and technical analysis conducted by The Intercept.

Behind the malware — which disguised itself as Microsoft drivers and was served via malicious, fake LinkedIn pages — lies a cooperative effort between the NSA and GCHQ. Belgacom has long since ousted the intruding software and is now working with a federal prosecutor to pursue a criminal investigation. Belgacom’s subversion by this malware — comparable in sophistication to the infamous Stuxnet, according to Symantec (which published its findings last Sunday) — led to the breach of EU offices.

Spying on foreign governments is what intelligence agencies are expected to do. But dumping malware into the operating systems of a communications provider generally isn’t. Belgacom’s infection is the only verified incident so far, but there are likely many, many more considering the Regin malware traces back nearly ten years.

Based on an analysis of the malware samples, Regin appears to have been developed over the course of more than a decade; The Intercept has identified traces of its components dating back as far as 2003. Regin was mentioned at a recent Hack.lu conference in Luxembourg, and Symantec’s report on Sunday said the firm had identified Regin on infected systems operated by private companies, government entities, and research institutes in countries such as Russia, Saudi Arabia, Mexico, Ireland, Belgium, and Iran.

GCHQ has issued boilerplate in response to The Intercept’s request for a comment. The NSA, on the other hand, apparently isn’t going to dignify this story with a non-denial denial, opting instead for something much more brusque:

“We are not going to comment on The Intercept’s speculation.”

What’s currently out there in the wild may not be as effective anymore. Belgacom discovered its infection around June 21, 2013, about a week before Der Spiegel published Snowden documents pointing to the digital infiltration of EU offices. The Intercept has made the malware available for download and states the following in its article.

Given that that it has been over a year since the Belgacom operation was publicly outed, The Intercept considers it likely that the GCHQ/NSA has replaced their toolkit and no current operations will be affected by the publication of these samples.

If so, then the two agencies involved have likely moved on to something better and less detectable. Being outed is no reason to stop spying, especially in other nations where legal protections range from “thin” to “nonexistent.”

Filed Under: gchq, malware, nsa, surveillance
Companies: belgacom, linkedin, microsoft