Slashdot Mirror
"Red October" Espionage Malware Campaign Uncovered
L3sPau1 writes "For five years, it hid in the weeds of networks used by Eastern European diplomats, government employees and scientific research organizations, stealing data and infecting more machines in an espionage campaign rivaling Flame and others of its ilk. The campaign, called Rocra or Red October by researchers at Kaspersky Lab, focused not only on workstations, but mobile devices and networking gear to gain a foothold inside strategic organizations. Once inside, attackers pivoted internally and stole everything from files on desktops, smartphones and FTP servers, to email databases using exploits developed in Chinese and Russian malware, Kaspersky researchers said."
It also stole first post! How devious!
Most of those IP addresses were in Switzerland, Kazakstan, Greece and Belarus
In other words, it's mostly collecting information from the least-interesting countries in Europe (geopolitically speaking.) One has to assume that the real target(s) are just being drowned out by collateral traffic.
If, and that's a big if, there actually is a defined target.
Its time we started to grill our malware detecors and virus scan makers because somethnig is going very very wrong. This makes the third or fourth MAJOR espionage virus/malware/trojan of a very large size that has been apparently rampaging for years. How can I now trust symantic to find a zero day and protect my systems when they have been unable to find things like red october and flame for years, and they are huge programs!
I am not a big conspiracy theorist, but something is going on here. Why aren't these things being spotted and reported?
Papa Legba come and open the gate
It will get out of hand, and we'll be lucky to live through it.
"The antivirus industry has a dirty little secret: its products are often not very good at stopping viruses."
(The linked New York Times story is a great read.)
And it starts with: "Like most of these APT-style targeted attacks, this one begins with a spear phishing message; one example provided was an announcement of a diplomatic car for sale.The email messages contain one of three attachments, each a different exploit of an existing vulnerability. "
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
When I was twelve, I helped my daddy set up an email server in our basement because some fool in China compromised a few diplomats' Gmail accounts. Well, this thing could compromise a coupla hundred accounts in Washington and New York and no one would know anything about it till it was all over.