Rocra Espionage Malware Campaign

FanJ · Jan 14, 2013

Rocra Espionage Malware Campaign Uncovered After Five Years of Activity

For five years, it hid in the weeds of networks used by Eastern European diplomats, government employees and scientific research organizations, stealing data and infecting more machines in an espionage campaign rivaling Flame and others of its ilk. The campaign, called Rocra or Red October by researchers at Kaspersky Lab, focused not only on workstations, but mobile devices and networking gear to gain a foothold inside strategic organizations. Once inside, attackers pivoted internally and stole everything from files on desktops, smartphones and FTP servers, to email databases using exploits developed in China and Russian malware, Kaspersky researchers said.
Click to expand...

The "Red October" Campaign - An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies

During the past five years, a high-level cyber-espionage campaign has successfully infiltrated computer networks at diplomatic, governmental and scientific research organizations, gathering data and intelligence from mobile devices, computer systems and network equipment.

Kaspersky Lab's researchers have spent several months analyzing this malware, which targets specific organizations mostly in Eastern Europe, former USSR members and countries in Central Asia, but also in Western Europe and North America.
Click to expand...

Who provided you with the samples?

Our partner who originally pointed us to this malware prefers to remain anonymous.
Click to expand...

Read more at above mentioned Kaspersky articles.

siljaline · Jan 14, 2013

'Red October' Cyber Espionage Campaign Rivals Flame in Complexity

Cyber security researchers have turned up evidence of a sophisticated cyber-espionage campaign that has been targeting political and business groups throughout the world for more than five years.
Click to expand...

• Article

Also: Red October cyber-espionage campaign targeted high-level government entities for 5 years.

A high-level cyber-espionage campaign has successfully infiltrated computer networks at diplomatic, governmental and scientific research organizations across the globe over the course of the last five years, security researchers say.
Click to expand...

• Article

TheKid7 · Jan 15, 2013

Another article on Red October:

http://www.cbsnews.com/8301-205_162...bs-finds-red-october-cyber-espionage-malware/

siljaline · Jan 15, 2013

F-Secure had this on Twitter Thanks, Mikko • Every month is Red October

siljaline · Jan 15, 2013

Java exploit used in Red October cyberespionage attacks, researchers say.

Seculert researchers identified a Java exploit and corresponding attack pages on Red October command and control servers.

The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert.
Click to expand...

• Article

ComputerSaysNo · Jan 16, 2013

Obviously China...

J_L · Jan 16, 2013

No, it must be CANADA! Their damn igloos make more than just cold water these days.

siljaline · Jan 16, 2013

"Operation Red October" - The Java Angle

Yesterday, Kaspersky Labs (KL) revealed a cyber espionage operation dubbed "Red October" According to the report, KL identified several hundred infections worldwide, primarily effecting government networks and diplomatic institutions located in Eastern Europe. As part of the operation, attackers sent spear phishing emails which contained an attached document. When opened, the documents exploited known vulnerabilities, and silently installed the malware.
Click to expand...

Article

elapsed · Jan 16, 2013

This is a lie. Look at the AV-C tests, look how many AV's score 100% of 0 day malware. This is not possible.

(sarcasm)

siljaline · Jan 18, 2013

Why Red October malware is the Swiss Army knife of espionage
http://arstechnica.com/security/201...malware-is-the-swiss-army-knife-of-espionage/

Red October espionage platform unplugged hours after its discovery
http://arstechnica.com/security/201...platform-unplugged-hours-after-its-discovery/

TheKid7 · Jan 21, 2013

Red October closes as Kaspersky publishes more details:

Almost as soon as Kaspersky began publishing details about the Red October cyberespionage network, the command and control systems behind the apparently five-year-old digital spying ring began closing down. According to a posting on Kaspersky's threatpost, the researchers who exposed the network on Monday say that "not only [are] the registrars killing the domains and the hosting providers killing the command-and-control servers but perhaps the attackers shutting down the whole operation"...........
Click to expand...

http://www.h-online.com/security/ne...Kaspersky-publishes-more-details-1787774.html

siljaline · Jan 21, 2013

Thanks for this This assumes no new command and control centres are launched.

TheKid7 said:

Red October closes as Kaspersky publishes more details:

http://www.h-online.com/security/ne...Kaspersky-publishes-more-details-1787774.html
Click to expand...

Log in or Sign up

Rocra Espionage Malware Campaign

FanJ Updates Team

siljaline Registered Member

TheKid7 Registered Member

siljaline Registered Member

siljaline Registered Member

ComputerSaysNo Guest

J_L Registered Member

siljaline Registered Member

elapsed Registered Member

siljaline Registered Member

TheKid7 Registered Member

siljaline Registered Member

Log in or Sign up

Rocra Espionage Malware Campaign

FanJ Updates Team

siljaline Registered Member

TheKid7 Registered Member

siljaline Registered Member

siljaline Registered Member

ComputerSaysNo Guest

J_L Registered Member

siljaline Registered Member

elapsed Registered Member

siljaline Registered Member

TheKid7 Registered Member

siljaline Registered Member

Useful Searches