Loading story…
Kaspersky reported that Regin is a highly sophisticated, modular cyber-espionage platform that operated for more than a decade and remained active in 2014, targeting telecom operators, government bodies, multinational political organizations, financial and research institutions, and selected individuals. Investigators identified 27 victim entities across 14 countries, including Belgian cryptographer Jean-Jacques Quisquater, and said the malware was designed for long-term intelligence collection and to support follow-on intrusions.
The platform used a multi-stage architecture, encrypted virtual file systems, and stealthy persistence mechanisms such as NTFS extended attributes and Windows registry storage, while routing communications through infected hosts over HTTP, HTTPS, SMB named pipes, Winsock, and ICMP. One of the most significant intrusions involved a GSM operator, where recovered logs showed Ericsson OSS MML commands, engineering account credentials, and activity affecting 136 cells in 2008, underscoring Regin’s ability to penetrate telecom infrastructure; Kaspersky said the operation’s scale, cost, and complexity strongly indicated nation-state backing, though it did not assign definitive blame.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of its research, Kaspersky described Regin as a highly sophisticated modular cyber-espionage platform with stealthy multi-stage components, encrypted virtual file systems, and multiple covert communication methods. The company reported identifying 27 victim entities in 14 countries and said the operation's scale and complexity suggested nation-state backing.
Kaspersky assessed that the Regin malware platform had likely been operating for over 10 years and was still active in 2014. Its victims included telecom operators, government bodies, financial and research institutions, and individuals across 14 countries.
Kaspersky recovered logs showing Regin operators using Ericsson OSS MML commands and engineering account credentials inside a GSM operator environment. The activity spanned 136 cells during April-May 2008, indicating deep access to telecom infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **Regin** malware platform was used in long-running cyber-espionage operations against telecom operators, government institutions, multinational political bodies, financial organizations, research groups, and selected individuals. The company said the framework showed hallmarks of **nation-state support**, citing its stealth, modular design, encrypted virtual file systems, and multi-stage architecture, with activity traced back to at least **2003** and infections still active in **2014**. Kaspersky identified **27 victim entities in 14 countries**, including Belgian cryptographer Jean-Jacques Quisquater. One of the most significant intrusions involved a **GSM operator**, where Regin operators accessed a **Base Station Controller** spanning **136 cells** and obtained engineering-account credentials. Kaspersky said the platform enabled intelligence collection and follow-on operations through covert persistence and internal communication components that built peer-to-peer and routed command-and-control paths inside victim networks, giving attackers deep visibility and control within compromised environments.
Aug 14, 2026
Researchers detailed **Attor**, a modular cyberespionage malware platform used against a small number of highly targeted victims, including diplomats, government institutions, and Russian-speaking users in Russia and Eastern Europe. ESET said the operation had been active since at least 2013, with another observed wave beginning in 2018 and continuing into mid-2019, and described the tooling as consistent with a focused intelligence-gathering campaign rather than broad criminal activity. The malware centers on a dispatcher component and encrypted plugins protected with **RSA-based asymmetric encryption**. Recovered modules support screenshots, audio recording, keylogging, clipboard logging, file upload, SOCKS proxying, device monitoring, persistence, and **Tor**-assisted communications to an FTP command-and-control server on an onion domain. Researchers highlighted an unusual GSM fingerprinting plugin that sends legacy **AT commands** over serial/COM ports to identify connected modems, older phones, or specialized GSM equipment, suggesting operators sought detailed profiling of attached devices for follow-on espionage activity.
Aug 15, 2026
Researchers uncovered compromised **UEFI firmware** images carrying a malicious implant that persisted in SPI flash and deployed a previously unseen malware family dubbed **MosaicRegressor**. The rogue firmware reused and modified components from Hacking Team’s leaked **VectorEDK** UEFI bootkit to drop `IntelUpdate.exe` into the Windows Startup folder and restore it if deleted, giving attackers durable access below the operating system. The finding followed earlier public reporting on **LoJax**, the first UEFI rootkit observed in the wild, underscoring that firmware-level persistence had moved from theory to active operations. The malware framework was used in targeted espionage campaigns from 2017 to 2019 against diplomats and NGO members in Africa, Asia, and Europe, with identified victims linked to North Korea. MosaicRegressor operated as a modular, multi-stage platform using multiple downloaders over HTTP/HTTPS, **BITS**, **WinHTTP**, and even `mail.ru` email accounts to retrieve payloads. Attribution remained low confidence, but researchers cited Chinese-language artifacts, a **Royal Road** weaponized document, and infrastructure overlap with activity associated with the **Winnti umbrella**, suggesting possible ties to a Chinese-speaking threat actor.
Aug 14, 2026