R2D2

R2D2 is a trojanized surveillance/backdoor malware publicly discussed in 2011 in connection with allegations that German authorities used a so-called government or state trojan for lawful interception. It has also been referred to as the German “federal trojan,” “Quellen-TKU,” and “0zapftis,” and ESET detected it as Win32/R2D2.A, a name derived from the transmission string “C3PO-r2d2-POE” used at the start of data transmission. Publicly released samples reportedly included a DLL and a system driver. Reported capabilities included keylogging, screenshot capture, audio recording, interception or targeting of applications such as Skype, MSN Messenger, Yahoo Messenger, and X-Lite, creation of a backdoor for data exfiltration, remote control of the infected system, and the ability to download and execute additional files. The reporting assessed that these capabilities exceeded simple wiretapping and made the tool functionally similar to an ordinary backdoor trojan. The content notes anecdotal links to Bavarian contractor DigiTask and possible Bavaria/Munich references in code strings, but also states that binary analysis alone could not reliably determine origin and that it was unclear whether the analyzed sample was one of DigiTask’s programs. The malware is associated in the content with German govware/state-trojan discussions rather than conventional criminal malware campaigns.