Loading story…
Kaspersky reported that the Regin malware platform was used in long-running cyber-espionage operations against telecom operators, government institutions, multinational political bodies, financial organizations, research groups, and selected individuals. The company said the framework showed hallmarks of nation-state support, citing its stealth, modular design, encrypted virtual file systems, and multi-stage architecture, with activity traced back to at least 2003 and infections still active in 2014. Kaspersky identified 27 victim entities in 14 countries, including Belgian cryptographer Jean-Jacques Quisquater.
One of the most significant intrusions involved a GSM operator, where Regin operators accessed a Base Station Controller spanning 136 cells and obtained engineering-account credentials. Kaspersky said the platform enabled intelligence collection and follow-on operations through covert persistence and internal communication components that built peer-to-peer and routed command-and-control paths inside victim networks, giving attackers deep visibility and control within compromised environments.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that Regin infections were still active in spring 2014, showing the espionage platform remained operational years after its earliest observed samples.
A decoded Regin activity log showed Ericsson OSS MML commands executed on a GSM operator's Base Station Controller across 136 cells, and the log appeared to include engineering account credentials. The activity log covered roughly one month from April 25, 2008 through May 27, 2008.
Kaspersky reported that some Regin samples carried timestamps dating back to 2003, indicating the platform was in use by at least that year.
Kaspersky published its analysis of Regin, describing it as a highly sophisticated modular espionage platform likely supported by a nation-state and identifying 27 victim entities across 14 countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that **Regin** is a highly sophisticated, modular cyber-espionage platform that operated for more than a decade and remained active in 2014, targeting telecom operators, government bodies, multinational political organizations, financial and research institutions, and selected individuals. Investigators identified 27 victim entities across 14 countries, including Belgian cryptographer Jean-Jacques Quisquater, and said the malware was designed for long-term intelligence collection and to support follow-on intrusions. The platform used a multi-stage architecture, encrypted virtual file systems, and stealthy persistence mechanisms such as NTFS extended attributes and Windows registry storage, while routing communications through infected hosts over **HTTP**, **HTTPS**, **SMB named pipes**, **Winsock**, and **ICMP**. One of the most significant intrusions involved a GSM operator, where recovered logs showed **Ericsson OSS MML** commands, engineering account credentials, and activity affecting 136 cells in 2008, underscoring Regin’s ability to penetrate telecom infrastructure; Kaspersky said the operation’s scale, cost, and complexity strongly indicated **nation-state** backing, though it did not assign definitive blame.
Jun 29, 2026
Researchers detailed **Attor**, a modular cyberespionage malware platform used against a small number of highly targeted victims, including diplomats, government institutions, and Russian-speaking users in Russia and Eastern Europe. ESET said the operation had been active since at least 2013, with another observed wave beginning in 2018 and continuing into mid-2019, and described the tooling as consistent with a focused intelligence-gathering campaign rather than broad criminal activity. The malware centers on a dispatcher component and encrypted plugins protected with **RSA-based asymmetric encryption**. Recovered modules support screenshots, audio recording, keylogging, clipboard logging, file upload, SOCKS proxying, device monitoring, persistence, and **Tor**-assisted communications to an FTP command-and-control server on an onion domain. Researchers highlighted an unusual GSM fingerprinting plugin that sends legacy **AT commands** over serial/COM ports to identify connected modems, older phones, or specialized GSM equipment, suggesting operators sought detailed profiling of attached devices for follow-on espionage activity.
Aug 15, 2026
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Aug 24, 2026