Malware

Regin

Regin is a highly sophisticated, modular multi-stage cyber-espionage platform used to provide attackers with deep remote control across victim networks. Reporting in the provided content describes it as a nation-state-grade framework active since at least 2003, with infections observed across at least 14 countries and victims including telecom operators, government institutions, multinational political bodies, financial institutions, research organizations, and individuals involved in advanced mathematical or cryptographical research. Kaspersky characterized Regin as the first known cyber-attack platform able to penetrate and monitor GSM networks, including modules that monitored GSM base station controllers, collected GSM cell and infrastructure data, and obtained engineering or administrative credentials that could enable manipulation of GSM network operations. The platform is extremely modular and staged, with later components stored in NTFS extended attributes or the registry on some systems, encrypted virtual file systems, and a dispatcher core supported by numerous plugins. Documented capabilities in the content include credential sniffing over HTTP, SMTP, and SMB; keylogging; modification of remote Registry information; lateral movement via Windows administrative shares; and command-and-control over multiple transports including HTTP, HTTPS, SMB named pipes, Winsock, and ICMP. Its command-and-control architecture is described as especially stealthy, using communication drones and peer-to-peer VPN-like routing through compromised victim organizations, with some compromised universities reportedly used as proxies to obscure origin and some victim networks linked so that only one node communicated externally. The content notes known external C2 servers at 61.67.114.73, 202.71.144.113, 203.199.89.80, and 194.183.237.145, and states Kaspersky detections included Trojan.Win32.Regin.gen and Rootkit.Win32.Regin. The operation has been associated in the content with Western or Five Eyes intelligence services, though the provided material stops short of definitive attribution. Additional references note a 2018 intrusion at Yandex using Regin that targeted technical information related to user account authentication and was reportedly detected and neutralized before causing damage.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence2

The log seems to contain not only the executed commands but also usernames and passwords of some engineering accounts

Execution

2 techniques

T1059.008Network Device CLIEvidence1

The entries in the log appear to contain Ericsson OSS MML (Man-Machine Language as defined by ITU-T) commands.

T1203Exploitation for Client ExecutionEvidence1

The exact method of the initial compromise remains a mystery, although several theories exist, which include man-in-the-middle attacks with browser zero-day exploits.

Persistence

2 techniques

T1078Valid AccountsEvidence2

The log seems to contain not only the executed commands but also usernames and passwords of some engineering accounts

T1112Modify RegistryEvidence7

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence2

The log seems to contain not only the executed commands but also usernames and passwords of some engineering accounts

Stealth

5 techniques

T1027.013Encrypted/Encoded FileEvidence1

The most interesting code from the Regin platform is stored in encrypted file storages, known as Virtual File Systems (VFSes).

T1036.001Invalid Code SignatureEvidence1

T1078Valid AccountsEvidence2

The log seems to contain not only the executed commands but also usernames and passwords of some engineering accounts

T1564.004NTFS File AttributesEvidence2

Further stages are stored either directly on the hard drive (for 64 bit systems), as NTFS Extended Attributes or registry entries.

T1564.005Hidden File SystemEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence7

Credential Access

3 techniques

T1040Network SniffingEvidence3

One particular Regin module is capable of monitoring GSM base station controllers, collecting data about GSM cells and the network infrastructure.

T1056.001KeyloggingEvidence1

T1557Adversary-in-the-MiddleEvidence1

The exact method of the initial compromise remains a mystery, although several theories exist, which include man-in-the-middle attacks with browser zero-day exploits.

Discovery

3 techniques

T1018Remote System DiscoveryEvidence1

"Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface." / "Regin appears to have functionality to modify remote Registry information."

T1040Network SniffingEvidence3

One particular Regin module is capable of monitoring GSM base station controllers, collecting data about GSM cells and the network infrastructure.

T1083File and Directory DiscoveryEvidence1

The Territorial Dispute scripts use digital signatures to hunt APT actors. Such signatures act like fingerprints for hacking groups — they can include file names or snippets of code from known malware that the advanced threat actors use repeatedly...

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

a platform – a software package, consisting of multiple modules, capable of infecting the entire networks of targeted organizations to seize full remote control at all possible levels.

T1021.002SMB/Windows Admin SharesEvidence2

The replication modules are copied to remote computers by using Windows administrative shares and then executed.

T1021.006Windows Remote ManagementEvidence1

“Shamoon…enables the RemoteRegistry service on the target system. It will then connect…with RegConnectRegistryW and modify the Registry…”

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1213Data from Information RepositoriesEvidence2

While in most cases, the attackers were focused on extracting sensitive information, such as e-mails and documents...

T1557Adversary-in-the-MiddleEvidence1

The exact method of the initial compromise remains a mystery, although several theories exist, which include man-in-the-middle attacks with browser zero-day exploits.

Command and Control

8 techniques

T1071Application Layer ProtocolEvidence1

The Regin platform uses an incredibly complex communication method between infected networks and command and control servers, allowing remote control and data transmission by stealth.

T1071.001Web ProtocolsEvidence5

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

T1071.002File Transfer ProtocolsEvidence2

Most victims communicate with another machine in their own internal network, through various protocols, as specified in the config file. These include HTTP and Windows network pipes.

T1090ProxyEvidence1

The C&C mechanism implemented in Regin is extremely sophisticated and relies on communication drones deployed by the attackers throughout the victim networks.

T1090.001Internal ProxyEvidence2

The machines located on the border of the network act as routers, effectively connecting victims from inside the network with C&Cs on the internet.

T1090.002External ProxyEvidence1

T1090.003Multi-hop ProxyEvidence2

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

T1095Non-Application Layer ProtocolEvidence3

27 – ICMP network listener using raw sockets

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app12 years ago

ip.v4●●●●●●●●●●●●View more in app12 years ago

ACTIVITY FEED

Recent activity

23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

23 SOURCESView more in app

securelistNews

May 13, 2021

Lessons learned from Flame, three years later | Securelist

Referenced as another advanced malware platform.

bleeping computerNews

Feb 12, 2021

Yandex suffers data breach after sysadmin sold access to user emails

A stealthy espionage malware platform used to compromise Yandex systems in an operation targeting technical information related to user account authentication.

web archiveNews

Apr 12, 2019

Who is GOSSIPGIRL?. Revisiting the O.G. Threat Actor… | by Chronicle | Chronicle Blog | Medium

A likely multi-country malware platform cited as an example of complex collaborative threat activity.

medium chronicle blogNews

Apr 12, 2019

Who is GOSSIPGIRL?. Revisiting the O.G. Threat Actor… | by Chronicle | Chronicle Blog | Medium

Referenced as a likely multi-country malware platform in a discussion about collaborative or supra threat actor models.

+19 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Regin