Loading story…
Researchers detailed Attor, a modular cyberespionage malware platform used against a small number of highly targeted victims, including diplomats, government institutions, and Russian-speaking users in Russia and Eastern Europe. ESET said the operation had been active since at least 2013, with another observed wave beginning in 2018 and continuing into mid-2019, and described the tooling as consistent with a focused intelligence-gathering campaign rather than broad criminal activity.
The malware centers on a dispatcher component and encrypted plugins protected with RSA-based asymmetric encryption. Recovered modules support screenshots, audio recording, keylogging, clipboard logging, file upload, SOCKS proxying, device monitoring, persistence, and Tor-assisted communications to an FTP command-and-control server on an onion domain. Researchers highlighted an unusual GSM fingerprinting plugin that sends legacy AT commands over serial/COM ports to identify connected modems, older phones, or specialized GSM equipment, suggesting operators sought detailed profiling of attached devices for follow-on espionage activity.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
ESET said the later Attor activity wave continued through July 2019, extending the known operational window for the malware's more recent campaign activity.
ESET observed another wave of Attor activity beginning in 2018, indicating continued use of the malware platform in targeted espionage campaigns.
ESET reported that the Attor malware family has been used since at least 2013 in targeted espionage operations against a narrow set of victims, including diplomats, government institutions, and Russian-speaking users in Russia and Eastern Europe.
ESET published research disclosing the Attor malware family, describing its modular architecture, espionage-focused plugins, and unusual GSM fingerprinting capability aimed at devices connected over serial COM ports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that **Regin** is a highly sophisticated, modular cyber-espionage platform that operated for more than a decade and remained active in 2014, targeting telecom operators, government bodies, multinational political organizations, financial and research institutions, and selected individuals. Investigators identified 27 victim entities across 14 countries, including Belgian cryptographer Jean-Jacques Quisquater, and said the malware was designed for long-term intelligence collection and to support follow-on intrusions. The platform used a multi-stage architecture, encrypted virtual file systems, and stealthy persistence mechanisms such as NTFS extended attributes and Windows registry storage, while routing communications through infected hosts over **HTTP**, **HTTPS**, **SMB named pipes**, **Winsock**, and **ICMP**. One of the most significant intrusions involved a GSM operator, where recovered logs showed **Ericsson OSS MML** commands, engineering account credentials, and activity affecting 136 cells in 2008, underscoring Regin’s ability to penetrate telecom infrastructure; Kaspersky said the operation’s scale, cost, and complexity strongly indicated **nation-state** backing, though it did not assign definitive blame.
Jun 29, 2026
Kaspersky reported that the **Regin** malware platform was used in long-running cyber-espionage operations against telecom operators, government institutions, multinational political bodies, financial organizations, research groups, and selected individuals. The company said the framework showed hallmarks of **nation-state support**, citing its stealth, modular design, encrypted virtual file systems, and multi-stage architecture, with activity traced back to at least **2003** and infections still active in **2014**. Kaspersky identified **27 victim entities in 14 countries**, including Belgian cryptographer Jean-Jacques Quisquater. One of the most significant intrusions involved a **GSM operator**, where Regin operators accessed a **Base Station Controller** spanning **136 cells** and obtained engineering-account credentials. Kaspersky said the platform enabled intelligence collection and follow-on operations through covert persistence and internal communication components that built peer-to-peer and routed command-and-control paths inside victim networks, giving attackers deep visibility and control within compromised environments.
Aug 14, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026