CINXE.COM

<!DOCTYPE html> <html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available" lang="en" dir="ltr"> <head> <meta charset="UTF-8"> <title>Regin (malware) - Wikipedia</title> <script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available";var cookie=document.cookie.match(/(?:^|; )enwikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":["",""],"wgDigitTransformTable":["",""],"wgDefaultDateFormat":"dmy", "wgMonthNames":["","January","February","March","April","May","June","July","August","September","October","November","December"],"wgRequestId":"2103a948-cf9d-4bf9-8b88-218615332305","wgCanonicalNamespace":"","wgCanonicalSpecialPageName":false,"wgNamespaceNumber":0,"wgPageName":"Regin_(malware)","wgTitle":"Regin (malware)","wgCurRevisionId":1221434010,"wgRevisionId":1221434010,"wgArticleId":44490360,"wgIsArticle":true,"wgIsRedirect":false,"wgAction":"view","wgUserName":null,"wgUserGroups":["*"],"wgCategories":["Articles with short description","Short description matches Wikidata","Rootkits","Computer access control","Privilege escalation exploits","Cryptographic attacks","Exploit-based worms","2014 in computing","Hacking in the 2010s","Spyware used by governments","Cybercrime in India"],"wgPageViewLanguage":"en","wgPageContentLanguage":"en","wgPageContentModel":"wikitext","wgRelevantPageName":"Regin_(malware)","wgRelevantArticleId":44490360,"wgIsProbablyEditable":true, "wgRelevantPageIsProbablyEditable":true,"wgRestrictionEdit":[],"wgRestrictionMove":[],"wgNoticeProject":"wikipedia","wgCiteReferencePreviewsActive":false,"wgFlaggedRevsParams":{"tags":{"status":{"levels":1}}},"wgMediaViewerOnClick":true,"wgMediaViewerEnabledByDefault":true,"wgPopupsFlags":0,"wgVisualEditor":{"pageLanguageCode":"en","pageLanguageDir":"ltr","pageVariantFallbacks":"en"},"wgMFDisplayWikibaseDescriptions":{"search":true,"watchlist":true,"tagline":false,"nearby":true},"wgWMESchemaEditAttemptStepOversample":false,"wgWMEPageLength":10000,"wgRelatedArticlesCompat":[],"wgCentralAuthMobileDomain":false,"wgEditSubmitButtonLabelPublish":true,"wgULSPosition":"interlanguage","wgULSisCompactLinksEnabled":false,"wgVector2022LanguageInHeader":true,"wgULSisLanguageSelectorEmpty":false,"wgWikibaseItemId":"Q18572753","wgCheckUserClientHintsHeadersJsApi":["brands","architecture","bitness","fullVersionList","mobile","model","platform","platformVersion"],"GEHomepageSuggestedEditsEnableTopics" :true,"wgGETopicsMatchModeEnabled":false,"wgGEStructuredTaskRejectionReasonTextInputEnabled":false,"wgGELevelingUpEnabledForUser":false};RLSTATE={"ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","ext.cite.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","ext.wikimediamessages.styles":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready","ext.wikimediaBadges":"ready"};RLPAGEMODULES=["ext.cite.ux-enhancements","site","mediawiki.page.ready","mediawiki.toc","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.ReferenceTooltips","ext.gadget.switcher","ext.urlShortener.toolbar","ext.centralauth.centralautologin","ext.popups","ext.visualEditor.desktopArticleTarget.init","ext.visualEditor.targetLoader", "ext.echo.centralauth","ext.eventLogging","ext.wikimediaEvents","ext.navigationTiming","ext.uls.interface","ext.cx.eventlogging.campaigns","ext.cx.uls.quick.actions","wikibase.client.vector-2022","ext.checkUser.clientHints","ext.quicksurveys.init","ext.growthExperiments.SuggestedEditSession","wikibase.sidebar.tracking"];</script> <script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"}); }];});});</script> <link rel="stylesheet" href="/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022"> <script async="" src="/w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022"></script> <meta name="ResourceLoaderDynamicStyles" content=""> <link rel="stylesheet" href="/w/load.php?lang=en&modules=site.styles&only=styles&skin=vector-2022"> <meta name="generator" content="MediaWiki 1.44.0-wmf.4"> <meta name="referrer" content="origin"> <meta name="referrer" content="origin-when-cross-origin"> <meta name="robots" content="max-image-preview:standard"> <meta name="format-detection" content="telephone=no"> <meta name="viewport" content="width=1120"> <meta property="og:title" content="Regin (malware) - Wikipedia"> <meta property="og:type" content="website"> <link rel="alternate" media="only screen and (max-width: 640px)" href="//en.m.wikipedia.org/wiki/Regin_(malware)"> <link rel="alternate" type="application/x-wiki" title="Edit this page" href="/w/index.php?title=Regin_(malware)&action=edit"> <link rel="apple-touch-icon" href="/static/apple-touch/wikipedia.png"> <link rel="icon" href="/static/favicon/wikipedia.ico"> <link rel="search" type="application/opensearchdescription+xml" href="/w/rest.php/v1/search" title="Wikipedia (en)"> <link rel="EditURI" type="application/rsd+xml" href="//en.wikipedia.org/w/api.php?action=rsd"> <link rel="canonical" href="https://en.wikipedia.org/wiki/Regin_(malware)"> <link rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en"> <link rel="alternate" type="application/atom+xml" title="Wikipedia Atom feed" href="/w/index.php?title=Special:RecentChanges&feed=atom"> <link rel="dns-prefetch" href="//meta.wikimedia.org" /> <link rel="dns-prefetch" href="//login.wikimedia.org"> </head> <body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject mw-editable page-Regin_malware rootpage-Regin_malware skin-vector-2022 action-view"><a class="mw-jump-link" href="#bodyContent">Jump to content</a> <div class="vector-header-container"> <header class="vector-header mw-header"> <div class="vector-header-start"> <nav class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-dropdown" class="vector-dropdown vector-main-menu-dropdown vector-button-flush-left vector-button-flush-right" > <input type="checkbox" id="vector-main-menu-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-main-menu-dropdown" class="vector-dropdown-checkbox " aria-label="Main menu" > <label id="vector-main-menu-dropdown-label" for="vector-main-menu-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-menu mw-ui-icon-wikimedia-menu"></span> <span class="vector-dropdown-label-text">Main menu</span> </label> <div class="vector-dropdown-content"> <div id="vector-main-menu-unpinned-container" class="vector-unpinned-container"> <div id="vector-main-menu" class="vector-main-menu vector-pinnable-element"> <div class="vector-pinnable-header vector-main-menu-pinnable-header vector-pinnable-header-unpinned" data-feature-name="main-menu-pinned" data-pinnable-element-id="vector-main-menu" data-pinned-container-id="vector-main-menu-pinned-container" data-unpinned-container-id="vector-main-menu-unpinned-container" > <div class="vector-pinnable-header-label">Main menu</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-main-menu.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-main-menu.unpin">hide</button> </div> <div id="p-navigation" class="vector-menu mw-portlet mw-portlet-navigation" > <div class="vector-menu-heading"> Navigation </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-mainpage-description" class="mw-list-item"><a href="/wiki/Main_Page" title="Visit the main page [z]" accesskey="z"><span>Main page</span></a></li><li id="n-contents" class="mw-list-item"><a href="/wiki/Wikipedia:Contents" title="Guides to browsing Wikipedia"><span>Contents</span></a></li><li id="n-currentevents" class="mw-list-item"><a href="/wiki/Portal:Current_events" title="Articles related to current events"><span>Current events</span></a></li><li id="n-randompage" class="mw-list-item"><a href="/wiki/Special:Random" title="Visit a randomly selected article [x]" accesskey="x"><span>Random article</span></a></li><li id="n-aboutsite" class="mw-list-item"><a href="/wiki/Wikipedia:About" title="Learn about Wikipedia and how it works"><span>About Wikipedia</span></a></li><li id="n-contactpage" class="mw-list-item"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us" title="How to contact Wikipedia"><span>Contact us</span></a></li> </ul> </div> </div> <div id="p-interaction" class="vector-menu mw-portlet mw-portlet-interaction" > <div class="vector-menu-heading"> Contribute </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-help" class="mw-list-item"><a href="/wiki/Help:Contents" title="Guidance on how to use and edit Wikipedia"><span>Help</span></a></li><li id="n-introduction" class="mw-list-item"><a href="/wiki/Help:Introduction" title="Learn how to edit Wikipedia"><span>Learn to edit</span></a></li><li id="n-portal" class="mw-list-item"><a href="/wiki/Wikipedia:Community_portal" title="The hub for editors"><span>Community portal</span></a></li><li id="n-recentchanges" class="mw-list-item"><a href="/wiki/Special:RecentChanges" title="A list of recent changes to Wikipedia [r]" accesskey="r"><span>Recent changes</span></a></li><li id="n-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_upload_wizard" title="Add images or other media for use on Wikipedia"><span>Upload file</span></a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> <a href="/wiki/Main_Page" class="mw-logo"> <img class="mw-logo-icon" src="/static/images/icons/wikipedia.png" alt="" aria-hidden="true" height="50" width="50"> <span class="mw-logo-container skin-invert"> <img class="mw-logo-wordmark" alt="Wikipedia" src="/static/images/mobile/copyright/wikipedia-wordmark-en.svg" style="width: 7.5em; height: 1.125em;"> <img class="mw-logo-tagline" alt="The Free Encyclopedia" src="/static/images/mobile/copyright/wikipedia-tagline-en.svg" width="117" height="13" style="width: 7.3125em; height: 0.8125em;"> </span> </a> </div> <div class="vector-header-end"> <div id="p-search" role="search" class="vector-search-box-vue vector-search-box-collapses vector-search-box-show-thumbnail vector-search-box-auto-expand-width vector-search-box"> <a href="/wiki/Special:Search" class="cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only search-toggle" title="Search Wikipedia [f]" accesskey="f"><span class="vector-icon mw-ui-icon-search mw-ui-icon-wikimedia-search"></span> <span>Search</span> </a> <div class="vector-typeahead-search-container"> <div class="cdx-typeahead-search cdx-typeahead-search--show-thumbnail cdx-typeahead-search--auto-expand-width"> <form action="/w/index.php" id="searchform" class="cdx-search-input cdx-search-input--has-end-button"> <div id="simpleSearch" class="cdx-search-input__input-wrapper" data-search-loc="header-moved"> <div class="cdx-text-input cdx-text-input--has-start-icon"> <input class="cdx-text-input__input" type="search" name="search" placeholder="Search Wikipedia" aria-label="Search Wikipedia" autocapitalize="sentences" title="Search Wikipedia [f]" accesskey="f" id="searchInput" > <span class="cdx-text-input__icon cdx-text-input__start-icon"></span> </div> <input type="hidden" name="title" value="Special:Search"> </div> <button class="cdx-button cdx-search-input__end-button">Search</button> </form> </div> </div> </div> <nav class="vector-user-links vector-user-links-wide" aria-label="Personal tools"> <div class="vector-user-links-main"> <div id="p-vector-user-menu-preferences" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-userpage" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-dropdown" class="vector-dropdown " title="Change the appearance of the page's font size, width, and color" > <input type="checkbox" id="vector-appearance-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-appearance-dropdown" class="vector-dropdown-checkbox " aria-label="Appearance" > <label id="vector-appearance-dropdown-label" for="vector-appearance-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-appearance mw-ui-icon-wikimedia-appearance"></span> <span class="vector-dropdown-label-text">Appearance</span> </label> <div class="vector-dropdown-content"> <div id="vector-appearance-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <div id="p-vector-user-menu-notifications" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-overflow" class="vector-menu mw-portlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en" class=""><span>Donate</span></a> </li> <li id="pt-createaccount-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:CreateAccount&returnto=Regin+%28malware%29" title="You are encouraged to create an account and log in; however, it is not mandatory" class=""><span>Create account</span></a> </li> <li id="pt-login-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:UserLogin&returnto=Regin+%28malware%29" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o" class=""><span>Log in</span></a> </li> </ul> </div> </div> </div> <div id="vector-user-links-dropdown" class="vector-dropdown vector-user-menu vector-button-flush-right vector-user-menu-logged-out" title="Log in and more options" > <input type="checkbox" id="vector-user-links-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-user-links-dropdown" class="vector-dropdown-checkbox " aria-label="Personal tools" > <label id="vector-user-links-dropdown-label" for="vector-user-links-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-ellipsis mw-ui-icon-wikimedia-ellipsis"></span> <span class="vector-dropdown-label-text">Personal tools</span> </label> <div class="vector-dropdown-content"> <div id="p-personal" class="vector-menu mw-portlet mw-portlet-personal user-links-collapsible-item" title="User menu" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport" class="user-links-collapsible-item mw-list-item"><a href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en"><span>Donate</span></a></li><li id="pt-createaccount" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:CreateAccount&returnto=Regin+%28malware%29" title="You are encouraged to create an account and log in; however, it is not mandatory"><span class="vector-icon mw-ui-icon-userAdd mw-ui-icon-wikimedia-userAdd"></span> <span>Create account</span></a></li><li id="pt-login" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:UserLogin&returnto=Regin+%28malware%29" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o"><span class="vector-icon mw-ui-icon-logIn mw-ui-icon-wikimedia-logIn"></span> <span>Log in</span></a></li> </ul> </div> </div> <div id="p-user-menu-anon-editor" class="vector-menu mw-portlet mw-portlet-user-menu-anon-editor" > <div class="vector-menu-heading"> Pages for logged out editors <a href="/wiki/Help:Introduction" aria-label="Learn more about editing"><span>learn more</span></a> </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-anoncontribs" class="mw-list-item"><a href="/wiki/Special:MyContributions" title="A list of edits made from this IP address [y]" accesskey="y"><span>Contributions</span></a></li><li id="pt-anontalk" class="mw-list-item"><a href="/wiki/Special:MyTalk" title="Discussion about edits from this IP address [n]" accesskey="n"><span>Talk</span></a></li> </ul> </div> </div> </div> </div> </nav> </div> </header> </div> <div class="mw-page-container"> <div class="mw-page-container-inner"> <div class="vector-sitenotice-container"> <div id="siteNotice"></div> </div> <div class="vector-column-start"> <div class="vector-main-menu-container"> <div id="mw-navigation"> <nav id="mw-panel" class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-pinned-container" class="vector-pinned-container"> </div> </nav> </div> </div> <div class="vector-sticky-pinned-container"> <nav id="mw-panel-toc" aria-label="Contents" data-event-name="ui.sidebar-toc" class="mw-table-of-contents-container vector-toc-landmark"> <div id="vector-toc-pinned-container" class="vector-pinned-container"> <div id="vector-toc" class="vector-toc vector-pinnable-element"> <div class="vector-pinnable-header vector-toc-pinnable-header vector-pinnable-header-pinned" data-feature-name="toc-pinned" data-pinnable-element-id="vector-toc" > <h2 class="vector-pinnable-header-label">Contents</h2> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-toc.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-toc.unpin">hide</button> </div> <ul class="vector-toc-contents" id="mw-panel-toc-list"> <li id="toc-mw-content-text" class="vector-toc-list-item vector-toc-level-1"> <a href="#" class="vector-toc-link"> <div class="vector-toc-text">(Top)</div> </a> </li> <li id="toc-Operation" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#Operation"> <div class="vector-toc-text"> <span class="vector-toc-numb">1</span> <span>Operation</span> </div> </a> <button aria-controls="toc-Operation-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> <span class="vector-icon mw-ui-icon-wikimedia-expand"></span> <span>Toggle Operation subsection</span> </button> <ul id="toc-Operation-sublist" class="vector-toc-list"> <li id="toc-Identification_and_naming" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Identification_and_naming"> <div class="vector-toc-text"> <span class="vector-toc-numb">1.1</span> <span>Identification and naming</span> </div> </a> <ul id="toc-Identification_and_naming-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Known_attacks_and_originator_of_malware" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#Known_attacks_and_originator_of_malware"> <div class="vector-toc-text"> <span class="vector-toc-numb">2</span> <span>Known attacks and originator of malware</span> </div> </a> <ul id="toc-Known_attacks_and_originator_of_malware-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-See_also" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#See_also"> <div class="vector-toc-text"> <span class="vector-toc-numb">3</span> <span>See also</span> </div> </a> <ul id="toc-See_also-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-References" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#References"> <div class="vector-toc-text"> <span class="vector-toc-numb">4</span> <span>References</span> </div> </a> <ul id="toc-References-sublist" class="vector-toc-list"> </ul> </li> </ul> </div> </div> </nav> </div> </div> <div class="mw-content-container"> <main id="content" class="mw-body"> <header class="mw-body-header vector-page-titlebar"> <nav aria-label="Contents" class="vector-toc-landmark"> <div id="vector-page-titlebar-toc" class="vector-dropdown vector-page-titlebar-toc vector-button-flush-left" > <input type="checkbox" id="vector-page-titlebar-toc-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-titlebar-toc" class="vector-dropdown-checkbox " aria-label="Toggle the table of contents" > <label id="vector-page-titlebar-toc-label" for="vector-page-titlebar-toc-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-listBullet mw-ui-icon-wikimedia-listBullet"></span> <span class="vector-dropdown-label-text">Toggle the table of contents</span> </label> <div class="vector-dropdown-content"> <div id="vector-page-titlebar-toc-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <h1 id="firstHeading" class="firstHeading mw-first-heading"><span class="mw-page-title-main">Regin (malware)</span></h1> <div id="p-lang-btn" class="vector-dropdown mw-portlet mw-portlet-lang" > <input type="checkbox" id="p-lang-btn-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-p-lang-btn" class="vector-dropdown-checkbox mw-interlanguage-selector" aria-label="Go to an article in another language. Available in 14 languages" > <label id="p-lang-btn-label" for="p-lang-btn-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--action-progressive mw-portlet-lang-heading-14" aria-hidden="true" ><span class="vector-icon mw-ui-icon-language-progressive mw-ui-icon-wikimedia-language-progressive"></span> <span class="vector-dropdown-label-text">14 languages</span> </label> <div class="vector-dropdown-content"> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li class="interlanguage-link interwiki-ar mw-list-item"><a href="https://ar.wikipedia.org/wiki/%D8%B1%D9%8A%D8%AC%D9%86_(%D8%A8%D8%B1%D9%85%D8%AC%D9%8A%D8%A9_%D8%AE%D8%A8%D9%8A%D8%AB%D8%A9)" title="ريجن (برمجية خبيثة) – Arabic" lang="ar" hreflang="ar" data-title="ريجن (برمجية خبيثة)" data-language-autonym="العربية" data-language-local-name="Arabic" class="interlanguage-link-target"><span>العربية</span></a></li><li class="interlanguage-link interwiki-de mw-list-item"><a href="https://de.wikipedia.org/wiki/Regin_(Trojanisches_Pferd)" title="Regin (Trojanisches Pferd) – German" lang="de" hreflang="de" data-title="Regin (Trojanisches Pferd)" data-language-autonym="Deutsch" data-language-local-name="German" class="interlanguage-link-target"><span>Deutsch</span></a></li><li class="interlanguage-link interwiki-es mw-list-item"><a href="https://es.wikipedia.org/wiki/Regin_(malware)" title="Regin (malware) – Spanish" lang="es" hreflang="es" data-title="Regin (malware)" data-language-autonym="Español" data-language-local-name="Spanish" class="interlanguage-link-target"><span>Español</span></a></li><li class="interlanguage-link interwiki-eu mw-list-item"><a href="https://eu.wikipedia.org/wiki/Regin_(malware)" title="Regin (malware) – Basque" lang="eu" hreflang="eu" data-title="Regin (malware)" data-language-autonym="Euskara" data-language-local-name="Basque" class="interlanguage-link-target"><span>Euskara</span></a></li><li class="interlanguage-link interwiki-fa mw-list-item"><a href="https://fa.wikipedia.org/wiki/%D8%B1%D8%AC%DB%8C%D9%86_(%D8%A8%D8%AF%D8%A7%D9%81%D8%B2%D8%A7%D8%B1)" title="رجین (بدافزار) – Persian" lang="fa" hreflang="fa" data-title="رجین (بدافزار)" data-language-autonym="فارسی" data-language-local-name="Persian" class="interlanguage-link-target"><span>فارسی</span></a></li><li class="interlanguage-link interwiki-fr mw-list-item"><a href="https://fr.wikipedia.org/wiki/Regin_(logiciel_malveillant)" title="Regin (logiciel malveillant) – French" lang="fr" hreflang="fr" data-title="Regin (logiciel malveillant)" data-language-autonym="Français" data-language-local-name="French" class="interlanguage-link-target"><span>Français</span></a></li><li class="interlanguage-link interwiki-ko mw-list-item"><a href="https://ko.wikipedia.org/wiki/%EB%A0%88%EA%B8%B4_(%EC%95%85%EC%84%B1_%EC%86%8C%ED%94%84%ED%8A%B8%EC%9B%A8%EC%96%B4)" title="레긴 (악성 소프트웨어) – Korean" lang="ko" hreflang="ko" data-title="레긴 (악성 소프트웨어)" data-language-autonym="한국어" data-language-local-name="Korean" class="interlanguage-link-target"><span>한국어</span></a></li><li class="interlanguage-link interwiki-he mw-list-item"><a href="https://he.wikipedia.org/wiki/%D7%A8%D7%92%D7%99%D7%9F_(%D7%A0%D7%95%D7%96%D7%A7%D7%94)" title="רגין (נוזקה) – Hebrew" lang="he" hreflang="he" data-title="רגין (נוזקה)" data-language-autonym="עברית" data-language-local-name="Hebrew" class="interlanguage-link-target"><span>עברית</span></a></li><li class="interlanguage-link interwiki-lmo mw-list-item"><a href="https://lmo.wikipedia.org/wiki/Regin" title="Regin – Lombard" lang="lmo" hreflang="lmo" data-title="Regin" data-language-autonym="Lombard" data-language-local-name="Lombard" class="interlanguage-link-target"><span>Lombard</span></a></li><li class="interlanguage-link interwiki-ja mw-list-item"><a href="https://ja.wikipedia.org/wiki/%E3%83%AC%E3%82%B8%E3%83%B3_(%E3%83%9E%E3%83%AB%E3%82%A6%E3%82%A7%E3%82%A2)" title="レジン (マルウェア) – Japanese" lang="ja" hreflang="ja" data-title="レジン (マルウェア)" data-language-autonym="日本語" data-language-local-name="Japanese" class="interlanguage-link-target"><span>日本語</span></a></li><li class="interlanguage-link interwiki-uz mw-list-item"><a href="https://uz.wikipedia.org/wiki/Regin" title="Regin – Uzbek" lang="uz" hreflang="uz" data-title="Regin" data-language-autonym="Oʻzbekcha / ўзбекча" data-language-local-name="Uzbek" class="interlanguage-link-target"><span>Oʻzbekcha / ўзбекча</span></a></li><li class="interlanguage-link interwiki-ru mw-list-item"><a href="https://ru.wikipedia.org/wiki/Regin_(%D0%B2%D0%B8%D1%80%D1%83%D1%81)" title="Regin (вирус) – Russian" lang="ru" hreflang="ru" data-title="Regin (вирус)" data-language-autonym="Русский" data-language-local-name="Russian" class="interlanguage-link-target"><span>Русский</span></a></li><li class="interlanguage-link interwiki-sl mw-list-item"><a href="https://sl.wikipedia.org/wiki/Regin_(zlonamerna_programska_oprema)" title="Regin (zlonamerna programska oprema) – Slovenian" lang="sl" hreflang="sl" data-title="Regin (zlonamerna programska oprema)" data-language-autonym="Slovenščina" data-language-local-name="Slovenian" class="interlanguage-link-target"><span>Slovenščina</span></a></li><li class="interlanguage-link interwiki-zh mw-list-item"><a href="https://zh.wikipedia.org/wiki/%E7%91%9E%E6%99%B6" title="瑞晶 – Chinese" lang="zh" hreflang="zh" data-title="瑞晶" data-language-autonym="中文" data-language-local-name="Chinese" class="interlanguage-link-target"><span>中文</span></a></li> </ul> <div class="after-portlet after-portlet-lang"><span class="wb-langlinks-edit wb-langlinks-link"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q18572753#sitelinks-wikipedia" title="Edit interlanguage links" class="wbc-editpage">Edit links</a></span></div> </div> </div> </div> </header> <div class="vector-page-toolbar"> <div class="vector-page-toolbar-container"> <div id="left-navigation"> <nav aria-label="Namespaces"> <div id="p-associated-pages" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-associated-pages" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-nstab-main" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/Regin_(malware)" title="View the content page [c]" accesskey="c"><span>Article</span></a></li><li id="ca-talk" class="vector-tab-noicon mw-list-item"><a href="/wiki/Talk:Regin_(malware)" rel="discussion" title="Discuss improvements to the content page [t]" accesskey="t"><span>Talk</span></a></li> </ul> </div> </div> <div id="vector-variants-dropdown" class="vector-dropdown emptyPortlet" > <input type="checkbox" id="vector-variants-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-variants-dropdown" class="vector-dropdown-checkbox " aria-label="Change language variant" > <label id="vector-variants-dropdown-label" for="vector-variants-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" ><span class="vector-dropdown-label-text">English</span> </label> <div class="vector-dropdown-content"> <div id="p-variants" class="vector-menu mw-portlet mw-portlet-variants emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> </div> </div> </nav> </div> <div id="right-navigation" class="vector-collapsible"> <nav aria-label="Views"> <div id="p-views" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-views" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-view" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/Regin_(malware)"><span>Read</span></a></li><li id="ca-edit" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=Regin_(malware)&action=edit" title="Edit this page [e]" accesskey="e"><span>Edit</span></a></li><li id="ca-history" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=Regin_(malware)&action=history" title="Past revisions of this page [h]" accesskey="h"><span>View history</span></a></li> </ul> </div> </div> </nav> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-dropdown" class="vector-dropdown vector-page-tools-dropdown" > <input type="checkbox" id="vector-page-tools-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-tools-dropdown" class="vector-dropdown-checkbox " aria-label="Tools" > <label id="vector-page-tools-dropdown-label" for="vector-page-tools-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" ><span class="vector-dropdown-label-text">Tools</span> </label> <div class="vector-dropdown-content"> <div id="vector-page-tools-unpinned-container" class="vector-unpinned-container"> <div id="vector-page-tools" class="vector-page-tools vector-pinnable-element"> <div class="vector-pinnable-header vector-page-tools-pinnable-header vector-pinnable-header-unpinned" data-feature-name="page-tools-pinned" data-pinnable-element-id="vector-page-tools" data-pinned-container-id="vector-page-tools-pinned-container" data-unpinned-container-id="vector-page-tools-unpinned-container" > <div class="vector-pinnable-header-label">Tools</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-page-tools.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-page-tools.unpin">hide</button> </div> <div id="p-cactions" class="vector-menu mw-portlet mw-portlet-cactions emptyPortlet vector-has-collapsible-items" title="More options" > <div class="vector-menu-heading"> Actions </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-more-view" class="selected vector-more-collapsible-item mw-list-item"><a href="/wiki/Regin_(malware)"><span>Read</span></a></li><li id="ca-more-edit" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=Regin_(malware)&action=edit" title="Edit this page [e]" accesskey="e"><span>Edit</span></a></li><li id="ca-more-history" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=Regin_(malware)&action=history"><span>View history</span></a></li> </ul> </div> </div> <div id="p-tb" class="vector-menu mw-portlet mw-portlet-tb" > <div class="vector-menu-heading"> General </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-whatlinkshere" class="mw-list-item"><a href="/wiki/Special:WhatLinksHere/Regin_(malware)" title="List of all English Wikipedia pages containing links to this page [j]" accesskey="j"><span>What links here</span></a></li><li id="t-recentchangeslinked" class="mw-list-item"><a href="/wiki/Special:RecentChangesLinked/Regin_(malware)" rel="nofollow" title="Recent changes in pages linked from this page [k]" accesskey="k"><span>Related changes</span></a></li><li id="t-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_Upload_Wizard" title="Upload files [u]" accesskey="u"><span>Upload file</span></a></li><li id="t-specialpages" class="mw-list-item"><a href="/wiki/Special:SpecialPages" title="A list of all special pages [q]" accesskey="q"><span>Special pages</span></a></li><li id="t-permalink" class="mw-list-item"><a href="/w/index.php?title=Regin_(malware)&oldid=1221434010" title="Permanent link to this revision of this page"><span>Permanent link</span></a></li><li id="t-info" class="mw-list-item"><a href="/w/index.php?title=Regin_(malware)&action=info" title="More information about this page"><span>Page information</span></a></li><li id="t-cite" class="mw-list-item"><a href="/w/index.php?title=Special:CiteThisPage&page=Regin_%28malware%29&id=1221434010&wpFormIdentifier=titleform" title="Information on how to cite this page"><span>Cite this page</span></a></li><li id="t-urlshortener" class="mw-list-item"><a href="/w/index.php?title=Special:UrlShortener&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FRegin_%28malware%29"><span>Get shortened URL</span></a></li><li id="t-urlshortener-qrcode" class="mw-list-item"><a href="/w/index.php?title=Special:QrCode&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FRegin_%28malware%29"><span>Download QR code</span></a></li> </ul> </div> </div> <div id="p-coll-print_export" class="vector-menu mw-portlet mw-portlet-coll-print_export" > <div class="vector-menu-heading"> Print/export </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="coll-download-as-rl" class="mw-list-item"><a href="/w/index.php?title=Special:DownloadAsPdf&page=Regin_%28malware%29&action=show-download-screen" title="Download this page as a PDF file"><span>Download as PDF</span></a></li><li id="t-print" class="mw-list-item"><a href="/w/index.php?title=Regin_(malware)&printable=yes" title="Printable version of this page [p]" accesskey="p"><span>Printable version</span></a></li> </ul> </div> </div> <div id="p-wikibase-otherprojects" class="vector-menu mw-portlet mw-portlet-wikibase-otherprojects" > <div class="vector-menu-heading"> In other projects </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-wikibase" class="wb-otherproject-link wb-otherproject-wikibase-dataitem mw-list-item"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q18572753" title="Structured data on this page hosted by Wikidata [g]" accesskey="g"><span>Wikidata item</span></a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> </div> </div> </div> <div class="vector-column-end"> <div class="vector-sticky-pinned-container"> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-pinned-container" class="vector-pinned-container"> </div> </nav> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-pinned-container" class="vector-pinned-container"> <div id="vector-appearance" class="vector-appearance vector-pinnable-element"> <div class="vector-pinnable-header vector-appearance-pinnable-header vector-pinnable-header-pinned" data-feature-name="appearance-pinned" data-pinnable-element-id="vector-appearance" data-pinned-container-id="vector-appearance-pinned-container" data-unpinned-container-id="vector-appearance-unpinned-container" > <div class="vector-pinnable-header-label">Appearance</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-appearance.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-appearance.unpin">hide</button> </div> </div> </div> </nav> </div> </div> <div id="bodyContent" class="vector-body" aria-labelledby="firstHeading" data-mw-ve-target-container> <div class="vector-body-before-content"> <div class="mw-indicators"> </div> <div id="siteSub" class="noprint">From Wikipedia, the free encyclopedia</div> </div> <div id="contentSub"><div id="mw-content-subtitle"></div></div> <div id="mw-content-text" class="mw-body-content"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr"><div class="shortdescription nomobile noexcerpt noprint searchaux" style="display:none">Sophisticated malware</div> <p><b>Regin</b> (also known as <b>Prax</b> or <b>QWERTY</b>) is a sophisticated <a href="/wiki/Malware" title="Malware">malware</a> and <a href="/wiki/Computer_hacking" class="mw-redirect" title="Computer hacking">hacking</a> toolkit used by United States' <a href="/wiki/National_Security_Agency" title="National Security Agency">National Security Agency</a> (NSA) and its British counterpart, the <a href="/wiki/Government_Communications_Headquarters" class="mw-redirect" title="Government Communications Headquarters">Government Communications Headquarters</a> (GCHQ).<sup id="cite_ref-nsa-und-gchq_1-0" class="reference"><a href="#cite_note-nsa-und-gchq-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup> It was first publicly revealed by <a href="/wiki/Kaspersky_Lab" title="Kaspersky Lab">Kaspersky Lab</a>, <a href="/wiki/NortonLifeLock" class="mw-redirect" title="NortonLifeLock">Symantec</a>, and <a href="/wiki/The_Intercept" title="The Intercept">The Intercept</a> in November 2014.<sup id="cite_ref-news_4-0" class="reference"><a href="#cite_note-news-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-intercept20041124_5-0" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> The malware targets specific users of <a href="/wiki/Microsoft_Windows" title="Microsoft Windows">Microsoft Windows</a>-based computers and has been linked to the US intelligence-gathering agency <a href="/wiki/NSA" class="mw-redirect" title="NSA">NSA</a> and its British counterpart, the <a href="/wiki/GCHQ" title="GCHQ">GCHQ</a>.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-NYT-20141124-NP_7-0" class="reference"><a href="#cite_note-NYT-20141124-NP-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup> <i>The Intercept</i> provided samples of Regin for download, including malware discovered at a Belgian telecommunications provider, <a href="/wiki/Belgacom" class="mw-redirect" title="Belgacom">Belgacom</a>.<sup id="cite_ref-intercept20041124_5-1" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> Kaspersky Lab says it first became aware of Regin in spring 2012, but some of the earliest samples date from 2003.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup> (The name Regin is first found on the <a href="/wiki/VirusTotal" title="VirusTotal">VirusTotal</a> website on 9 March 2011.<sup id="cite_ref-intercept20041124_5-2" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>) Among computers infected worldwide by Regin, 28 percent were in <a href="/wiki/Russia" title="Russia">Russia</a>, 24 percent in <a href="/wiki/Saudi_Arabia" title="Saudi Arabia">Saudi Arabia</a>, 9 percent each in <a href="/wiki/Mexico" title="Mexico">Mexico</a> and <a href="/wiki/Ireland" title="Ireland">Ireland</a>, and 5 percent in each of <a href="/wiki/India" title="India">India</a>, <a href="/wiki/Afghanistan" title="Afghanistan">Afghanistan</a>, <a href="/wiki/Iran" title="Iran">Iran</a>, <a href="/wiki/Belgium" title="Belgium">Belgium</a>, <a href="/wiki/Austria" title="Austria">Austria</a>, and <a href="/wiki/Pakistan" title="Pakistan">Pakistan</a>.<sup id="cite_ref-symantecblog_10-0" class="reference"><a href="#cite_note-symantecblog-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> </p><p><a href="/wiki/Kaspersky_Lab" title="Kaspersky Lab">Kaspersky</a> has said the malware's main victims are private individuals, small businesses and <a href="/wiki/Telecommunications_service_provider" class="mw-redirect" title="Telecommunications service provider">telecom companies</a>. Regin has been compared to <a href="/wiki/Stuxnet" title="Stuxnet">Stuxnet</a> and is thought to have been developed by "well-resourced teams of developers", possibly a <a href="/wiki/Western_culture" title="Western culture">Western</a> government, as a targeted multi-purpose data collection tool.<sup id="cite_ref-bbc_11-0" class="reference"><a href="#cite_note-bbc-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-whitepapers_12-0" class="reference"><a href="#cite_note-whitepapers-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-whitepaperk_13-0" class="reference"><a href="#cite_note-whitepaperk-13"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup> </p><p>According to <i><a href="/wiki/Die_Welt" title="Die Welt">Die Welt</a></i>, security experts at <a href="/wiki/Microsoft" title="Microsoft">Microsoft</a> gave it the name "Regin" in 2011, after the cunning Norse dwarf <a href="/wiki/Regin" title="Regin">Regin</a>.<sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup> </p> <meta property="mw:PageProp/toc" /> <div class="mw-heading mw-heading2"><h2 id="Operation">Operation</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Regin_(malware)&action=edit&section=1" title="Edit section: Operation"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>Regin uses a modular approach allowing it to load features that exactly fit the target, enabling customized spying. The design makes it highly suited for persistent, long-term mass surveillance operations against targets.<sup id="cite_ref-15" class="reference"><a href="#cite_note-15"><span class="cite-bracket">[</span>15<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-scmagazine_16-0" class="reference"><a href="#cite_note-scmagazine-16"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup> </p><p>Regin is stealthy and does not store multiple files on the infected system; instead it uses its own encrypted <a href="/wiki/Virtual_file_system" title="Virtual file system">virtual file system</a> (EVFS) entirely contained within what looks like a single file with an innocuous name to the host, within which files are identified only by a numeric code, not a name. The EVFS employs a variant encryption of the rarely used <a href="/wiki/RC5_cipher" class="mw-redirect" title="RC5 cipher">RC5 cipher</a>.<sup id="cite_ref-scmagazine_16-1" class="reference"><a href="#cite_note-scmagazine-16"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup> Regin communicates over the Internet using <a href="/wiki/Internet_Control_Message_Protocol" title="Internet Control Message Protocol">ICMP</a>/<a href="/wiki/Ping_(networking_utility)" title="Ping (networking utility)">ping</a>, commands embedded in <a href="/wiki/HTTP_cookies" class="mw-redirect" title="HTTP cookies">HTTP cookies</a> and custom <a href="/wiki/Transmission_Control_Protocol" title="Transmission Control Protocol">TCP</a> and <a href="/wiki/User_Datagram_Protocol" title="User Datagram Protocol">UDP</a> protocols with a <a href="/wiki/Command_and_control_server" class="mw-redirect" title="Command and control server">command and control server</a> which can control operations, upload additional <a href="/wiki/Payload_(computing)" title="Payload (computing)">payloads</a>, etc.<sup id="cite_ref-symantecblog_10-1" class="reference"><a href="#cite_note-symantecblog-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-whitepapers_12-1" class="reference"><a href="#cite_note-whitepapers-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading3"><h3 id="Identification_and_naming">Identification and naming</h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Regin_(malware)&action=edit&section=2" title="Edit section: Identification and naming"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>Symantec says that both it and Kaspersky identified the malware as <i>Backdoor.Regin</i>.<sup id="cite_ref-symantecblog_10-2" class="reference"><a href="#cite_note-symantecblog-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> Most antivirus programs, including Kaspersky, (as of October 2015) do NOT identify the sample of Regin released by The Intercept as malware.<sup id="cite_ref-17" class="reference"><a href="#cite_note-17"><span class="cite-bracket">[</span>17<span class="cite-bracket">]</span></a></sup> On 9 March 2011 Microsoft added related entries to its Malware Encyclopedia;<sup id="cite_ref-18" class="reference"><a href="#cite_note-18"><span class="cite-bracket">[</span>18<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-19" class="reference"><a href="#cite_note-19"><span class="cite-bracket">[</span>19<span class="cite-bracket">]</span></a></sup> later two more variants, <i>Regin.B</i> and <i>Regin.C</i> were added. Microsoft appears to call the 64-bit variants of Regin <i>Prax.A</i> and <i>Prax.B</i>. The Microsoft entries do not have any technical information.<sup id="cite_ref-intercept20041124_5-3" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> Both Kaspersky and Symantec have published <a href="/wiki/White_paper" title="White paper">white papers</a> with information they learned about the malware.<sup id="cite_ref-whitepapers_12-2" class="reference"><a href="#cite_note-whitepapers-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-whitepaperk_13-1" class="reference"><a href="#cite_note-whitepaperk-13"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading2"><h2 id="Known_attacks_and_originator_of_malware">Known attacks and originator of malware</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Regin_(malware)&action=edit&section=3" title="Edit section: Known attacks and originator of malware"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>German news magazine <i><a href="/wiki/Der_Spiegel" title="Der Spiegel">Der Spiegel</a></i> reported in June 2013 that the US <a href="/wiki/Intelligence" title="Intelligence">intelligence</a> <a href="/wiki/National_Security_Agency" title="National Security Agency">National Security Agency</a> (NSA) had conducted online surveillance on both <a href="/wiki/European_Union" title="European Union">European Union</a> (EU) citizens and EU institutions. The information derives from <a href="/wiki/Global_surveillance_disclosures_(2013%E2%80%93present)" class="mw-redirect" title="Global surveillance disclosures (2013–present)">secret documents obtained</a> by former NSA worker <a href="/wiki/Edward_Snowden" title="Edward Snowden">Edward Snowden</a>. Both <i>Der Spiegel</i> and <i><a href="/wiki/The_Intercept" title="The Intercept">The Intercept</a></i> quote a secret 2010 NSA document stating that it made <a href="/wiki/Cyber-attack" class="mw-redirect" title="Cyber-attack">cyberattacks</a> that year, without specifying the malware used, against the EU diplomatic representations in <a href="/wiki/Washington,_D.C." title="Washington, D.C.">Washington, D.C.</a> and its representations to the <a href="/wiki/United_Nations" title="United Nations">United Nations</a>.<sup id="cite_ref-intercept20041124_5-4" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-spiegel_20-0" class="reference"><a href="#cite_note-spiegel-20"><span class="cite-bracket">[</span>20<span class="cite-bracket">]</span></a></sup> Signs identifying the software used as Regin were found by investigators on infected machines. </p><p><i>The Intercept</i> reported that, in 2013, the UK's <a href="/wiki/GCHQ" title="GCHQ">GCHQ</a> attacked <a href="/wiki/Belgacom" class="mw-redirect" title="Belgacom">Belgacom</a>, Belgium's largest telecommunications company.<sup id="cite_ref-intercept20041124_5-5" class="reference"><a href="#cite_note-intercept20041124-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> These attacks may have led to Regin coming to the attention of security companies. Based on analysis done by IT security firm Fox IT, <i>Der Spiegel</i> reported in November 2014, that Regin is a tool of the UK and USA intelligence agencies. Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the <a href="/wiki/NSA_ANT_catalog" class="mw-redirect" title="NSA ANT catalog">NSA ANT catalog</a> under the names "Straitbizarre" and "Unitedrake". Fox IT did not name the customer, but <i>Der Spiegel</i> mentioned that among the customers of Fox IT is Belgacom and cited the head of Fox IT, Ronald Prins, who stated that they are not allowed to speak about what they found in the Belgacom network.<sup id="cite_ref-nsa-und-gchq_1-1" class="reference"><a href="#cite_note-nsa-und-gchq-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> </p><p>In December 2014, German newspaper <i><a href="/wiki/Bild" title="Bild">Bild</a></i> reported that Regin was found on a <a href="/wiki/USB_flash_drive" title="USB flash drive">USB flash drive</a> used by a staff member of Chancellor <a href="/wiki/Angela_Merkel" title="Angela Merkel">Angela Merkel</a>. Checks of all high-security laptops in the <a href="/wiki/German_Chancellery" title="German Chancellery">German Chancellery</a> revealed no additional infections.<sup id="cite_ref-21" class="reference"><a href="#cite_note-21"><span class="cite-bracket">[</span>21<span class="cite-bracket">]</span></a></sup> </p><p>Regin was used in October and November 2018 to hack the research and development unit of <a href="/wiki/Yandex" title="Yandex">Yandex</a>.<sup id="cite_ref-MoscowTimes_22-0" class="reference"><a href="#cite_note-MoscowTimes-22"><span class="cite-bracket">[</span>22<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading2"><h2 id="See_also">See also</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Regin_(malware)&action=edit&section=4" title="Edit section: See also"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <ul><li><a href="/wiki/Advanced_persistent_threat" title="Advanced persistent threat">Advanced persistent threat</a></li> <li><a href="/wiki/Cyberwarfare_in_the_United_States" class="mw-redirect" title="Cyberwarfare in the United States">Cyberwarfare in the United States</a></li> <li><a href="/wiki/NSA_ANT_catalog" class="mw-redirect" title="NSA ANT catalog">NSA ANT catalog</a></li> <li><a href="/wiki/Stuxnet" title="Stuxnet">Stuxnet</a></li> <li><a href="/wiki/WARRIOR_PRIDE" title="WARRIOR PRIDE">WARRIOR PRIDE</a></li></ul> <div class="mw-heading mw-heading2"><h2 id="References">References</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Regin_(malware)&action=edit&section=5" title="Edit section: References"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <style data-mw-deduplicate="TemplateStyles:r1239543626">.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}</style><div class="reflist reflist-columns references-column-width" style="column-width: 30em;"> <ol class="references"> <li id="cite_note-nsa-und-gchq-1"><span class="mw-cite-backlink">^ <a href="#cite_ref-nsa-und-gchq_1-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-nsa-und-gchq_1-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein-werkzeug-von-nsa-und-gchq-a-1004950.html">Christian Stöcker, Marcel Rosenbach " Spionage-Software: Super-Trojaner Regin ist eine NSA-Geheimwaffe" Der Spiegel, November 25, 2014</a></span> </li> <li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><style data-mw-deduplicate="TemplateStyles:r1238218222">.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/d/d6/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/a/aa/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("//upload.wikimedia.org/wikipedia/commons/4/4c/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}</style><cite class="citation news cs1"><a rel="nofollow" class="external text" href="http://www.spiegel.de/international/world/regin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html">"Experts Unmask 'Regin' Trojan as NSA Tool"</a>. <i>Spiegel.de</i><span class="reference-accessdate">. Retrieved <span class="nowrap">9 November</span> 2021</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Spiegel.de&rft.atitle=Experts+Unmask+%27Regin%27+Trojan+as+NSA+Tool&rft_id=http%3A%2F%2Fwww.spiegel.de%2Finternational%2Fworld%2Fregin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFZetter" class="citation magazine cs1">Zetter, Kim. <a rel="nofollow" class="external text" href="https://www.wired.com/2014/11/mysteries-of-the-malware-regin/">"Researchers Uncover Government Spy Tool Used to Hack Telecoms and Belgian Cryptographer"</a>. <i>Wired</i>. <a href="/wiki/ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1059-1028">1059-1028</a><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-02-22</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Wired&rft.atitle=Researchers+Uncover+Government+Spy+Tool+Used+to+Hack+Telecoms+and+Belgian+Cryptographer&rft.issn=1059-1028&rft.aulast=Zetter&rft.aufirst=Kim&rft_id=https%3A%2F%2Fwww.wired.com%2F2014%2F11%2Fmysteries-of-the-malware-regin%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-news-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-news_4-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://securelist.com/blog/research/67741/regin-nation-state-ownage-of-gsm-networks">"Regin Revealed"</a>. Kaspersky Lab. 24 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">24 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Regin+Revealed&rft.pub=Kaspersky+Lab&rft.date=2014-11-24&rft_id=http%3A%2F%2Fsecurelist.com%2Fblog%2Fresearch%2F67741%2Fregin-nation-state-ownage-of-gsm-networks&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-intercept20041124-5"><span class="mw-cite-backlink">^ <a href="#cite_ref-intercept20041124_5-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-intercept20041124_5-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-intercept20041124_5-2"><sup><i><b>c</b></i></sup></a> <a href="#cite_ref-intercept20041124_5-3"><sup><i><b>d</b></i></sup></a> <a href="#cite_ref-intercept20041124_5-4"><sup><i><b>e</b></i></sup></a> <a href="#cite_ref-intercept20041124_5-5"><sup><i><b>f</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMarquis-BoireGuarnieriGallagher2014" class="citation web cs1">Marquis-Boire, Morgan; Guarnieri, Claudio; Gallagher, Ryan (24 November 2014). <a rel="nofollow" class="external text" href="https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/">"Secret Malware in European Union Attack Linked to U.S. and British Intelligence"</a>. The Intercept.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Secret+Malware+in+European+Union+Attack+Linked+to+U.S.+and+British+Intelligence&rft.pub=The+Intercept&rft.date=2014-11-24&rft.aulast=Marquis-Boire&rft.aufirst=Morgan&rft.au=Guarnieri%2C+Claudio&rft.au=Gallagher%2C+Ryan&rft_id=https%3A%2F%2Ffirstlook.org%2Ftheintercept%2F2014%2F11%2F24%2Fsecret-regin-malware-belgacom-nsa-gchq%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://arstechnica.com/tech-policy/2015/10/top-german-official-infected-by-highly-advanced-spy-trojan-with-nsa-ties/">"Top German official infected by highly advanced spy trojan with NSA ties"</a>. 26 October 2015.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Top+German+official+infected+by+highly+advanced+spy+trojan+with+NSA+ties&rft.date=2015-10-26&rft_id=https%3A%2F%2Farstechnica.com%2Ftech-policy%2F2015%2F10%2Ftop-german-official-infected-by-highly-advanced-spy-trojan-with-nsa-ties%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-NYT-20141124-NP-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-NYT-20141124-NP_7-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFPerlroth2014" class="citation news cs1">Perlroth, Nicole (24 November 2014). <a rel="nofollow" class="external text" href="http://bits.blogs.nytimes.com/2014/11/24/symantec-discovers-spy-code-lurking-on-computer-networks/">"Symantec Discovers 'Regin' Spy Code Lurking on Computer Networks"</a>. <i><a href="/wiki/New_York_Times" class="mw-redirect" title="New York Times">New York Times</a></i><span class="reference-accessdate">. Retrieved <span class="nowrap">25 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=New+York+Times&rft.atitle=Symantec+Discovers+%27Regin%27+Spy+Code+Lurking+on+Computer+Networks&rft.date=2014-11-24&rft.aulast=Perlroth&rft.aufirst=Nicole&rft_id=http%3A%2F%2Fbits.blogs.nytimes.com%2F2014%2F11%2F24%2Fsymantec-discovers-spy-code-lurking-on-computer-networks%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFGallagher2014" class="citation web cs1">Gallagher, Ryan (13 December 2014). <a rel="nofollow" class="external text" href="https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/">"The Inside Story of How British Spies Hacked Belgium's Largest Telco"</a>. The Intercept.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=The+Inside+Story+of+How+British+Spies+Hacked+Belgium%27s+Largest+Telco&rft.pub=The+Intercept&rft.date=2014-12-13&rft.aulast=Gallagher&rft.aufirst=Ryan&rft_id=https%3A%2F%2Ffirstlook.org%2Ftheintercept%2F2014%2F12%2F13%2Fbelgacom-hack-gchq-inside-story%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.kaspersky.com/about/news/virus/2014/Regin-a-malicious-platform-capable-of-spying-on-GSM-networks">Kaspersky:Regin: a malicious platform capable of spying on GSM networks</a>, 24 November 2014</span> </li> <li id="cite_note-symantecblog-10"><span class="mw-cite-backlink">^ <a href="#cite_ref-symantecblog_10-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-symantecblog_10-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-symantecblog_10-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=b2a9256f-0486-4819-a833-a7260d7b77e8&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments">"Regin: Top-tier espionage tool enables stealthy surveillance"</a>. Symantec. 23 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">25 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Regin%3A+Top-tier+espionage+tool+enables+stealthy+surveillance&rft.pub=Symantec&rft.date=2014-11-23&rft_id=https%3A%2F%2Fcommunity.broadcom.com%2Fsymantecenterprise%2Fcommunities%2Fcommunity-home%2Flibrarydocuments%2Fviewdocument%3FDocumentKey%3Db2a9256f-0486-4819-a833-a7260d7b77e8%26CommunityKey%3D1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68%26tab%3Dlibrarydocuments&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-bbc-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-bbc_11-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation news cs1"><a rel="nofollow" class="external text" href="https://www.bbc.com/news/technology-30171614">"BBC News - Regin, new computer spying bug, discovered by Symantec"</a>. <i>BBC News</i>. 23 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">23 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=BBC+News&rft.atitle=BBC+News+-+Regin%2C+new+computer+spying+bug%2C+discovered+by+Symantec&rft.date=2014-11-23&rft_id=https%3A%2F%2Fwww.bbc.com%2Fnews%2Ftechnology-30171614&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-whitepapers-12"><span class="mw-cite-backlink">^ <a href="#cite_ref-whitepapers_12-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-whitepapers_12-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-whitepapers_12-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20190907005119/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf">"Regin White Paper"</a> <span class="cs1-format">(PDF)</span>. Symantec. Archived from <a rel="nofollow" class="external text" href="http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf">the original</a> <span class="cs1-format">(PDF)</span> on 7 September 2019<span class="reference-accessdate">. Retrieved <span class="nowrap">23 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Regin+White+Paper&rft.pub=Symantec&rft_id=http%3A%2F%2Fwww.symantec.com%2Fcontent%2Fen%2Fus%2Fenterprise%2Fmedia%2Fsecurity_response%2Fwhitepapers%2Fregin-analysis.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-whitepaperk-13"><span class="mw-cite-backlink">^ <a href="#cite_ref-whitepaperk_13-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-whitepaperk_13-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf">"Regin White Paper"</a> <span class="cs1-format">(PDF)</span>. Kaspersky Lab<span class="reference-accessdate">. Retrieved <span class="nowrap">24 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Regin+White+Paper&rft.pub=Kaspersky+Lab&rft_id=https%3A%2F%2Fmedia.kasperskycontenthub.com%2Fwp-content%2Fuploads%2Fsites%2F43%2F2018%2F03%2F08070305%2FKaspersky_Lab_whitepaper_Regin_platform_eng.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFBenedikt_Fuest2014" class="citation news cs1">Benedikt Fuest (24 November 2014). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20141128080847/http://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html">"Ein Computervirus, so mächtig wie keines zuvor"</a>. <i>Die Welt</i>. Archived from <a rel="nofollow" class="external text" href="https://www.welt.de/wirtschaft/webwelt/article134685163/Ein-Computervirus-so-maechtig-wie-keines-zuvor.html">the original</a> on 28 November 2014.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Die+Welt&rft.atitle=Ein+Computervirus%2C+so+m%C3%A4chtig+wie+keines+zuvor&rft.date=2014-11-24&rft.au=Benedikt+Fuest&rft_id=https%3A%2F%2Fwww.welt.de%2Fwirtschaft%2Fwebwelt%2Farticle134685163%2FEin-Computervirus-so-maechtig-wie-keines-zuvor.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-15"><span class="mw-cite-backlink"><b><a href="#cite_ref-15">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20170218064037/http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/">"Regin Malware - 'State-Sponsored' Spying Tool Targeted Govts"</a>. <i>The Hacking Post - Latest hacking News & Security Updates</i>. Archived from <a rel="nofollow" class="external text" href="http://hackingpost.com/regin-malware-state-sponsored-spying-tool-targeted-govts/">the original</a> on 2017-02-18<span class="reference-accessdate">. Retrieved <span class="nowrap">2014-11-24</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=The+Hacking+Post+-+Latest+hacking+News+%26+Security+Updates&rft.atitle=Regin+Malware+-+%27State-Sponsored%27+Spying+Tool+Targeted+Govts&rft_id=http%3A%2F%2Fhackingpost.com%2Fregin-malware-state-sponsored-spying-tool-targeted-govts%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-scmagazine-16"><span class="mw-cite-backlink">^ <a href="#cite_ref-scmagazine_16-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-scmagazine_16-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.scmagazineuk.com/nsa-gchq-or-both-behind-stuxnet-like-regin-malware/article/384888/">"NSA, GCHQ or both behind Stuxnet-like Regin malware?"</a>. scmagazineuk.com. 24 November 2014<span class="reference-accessdate">. Retrieved <span class="nowrap">25 November</span> 2014</span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=NSA%2C+GCHQ+or+both+behind+Stuxnet-like+Regin+malware%3F&rft.pub=scmagazineuk.com&rft.date=2014-11-24&rft_id=http%3A%2F%2Fwww.scmagazineuk.com%2Fnsa-gchq-or-both-behind-stuxnet-like-regin-malware%2Farticle%2F384888%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-17"><span class="mw-cite-backlink"><b><a href="#cite_ref-17">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="https://www.virustotal.com/en/file/4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be/analysis/">Virustotal: Detection ratio: 21 / 56 </a></span> </li> <li id="cite_note-18"><span class="mw-cite-backlink"><b><a href="#cite_ref-18">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.microsoft.com/security/portal/mmpc/default.aspx">Microsoft Malware Protection Center, click button "Malware Encyclopedia</a></span> </li> <li id="cite_note-19"><span class="mw-cite-backlink"><b><a href="#cite_ref-19">^</a></b></span> <span class="reference-text"><a rel="nofollow" class="external text" href="http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3AWinNT%2FRegin.A#tab=1">Microsoft Protection Center: Trojan:WinNT/Regin.A</a></span> </li> <li id="cite_note-spiegel-20"><span class="mw-cite-backlink"><b><a href="#cite_ref-spiegel_20-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFPoitrasRosenbachSchmidStark2013" class="citation web cs1">Poitras, Laura; Rosenbach, Marcel; Schmid, Fidelius; Stark, Holger (29 June 2013). <a rel="nofollow" class="external text" href="http://www.spiegel.de/international/europe/nsa-spied-on-european-union-offices-a-908590.html">"Attacks from America: NSA Spied on European Union Offices"</a>. Der Spiegel.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Attacks+from+America%3A+NSA+Spied+on+European+Union+Offices&rft.pub=Der+Spiegel&rft.date=2013-06-29&rft.aulast=Poitras&rft.aufirst=Laura&rft.au=Rosenbach%2C+Marcel&rft.au=Schmid%2C+Fidelius&rft.au=Stark%2C+Holger&rft_id=http%3A%2F%2Fwww.spiegel.de%2Finternational%2Feurope%2Fnsa-spied-on-european-union-offices-a-908590.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-21"><span class="mw-cite-backlink"><b><a href="#cite_ref-21">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation news cs1"><a rel="nofollow" class="external text" href="http://www.dw.de/german-government-denies-falling-victim-to-cyber-attack/a-18158951">"German government denies falling victim to cyber attack"</a>. <i>Deutsche Welle</i>. 29 December 2014.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Deutsche+Welle&rft.atitle=German+government+denies+falling+victim+to+cyber+attack&rft.date=2014-12-29&rft_id=http%3A%2F%2Fwww.dw.de%2Fgerman-government-denies-falling-victim-to-cyber-attack%2Fa-18158951&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> <li id="cite_note-MoscowTimes-22"><span class="mw-cite-backlink"><b><a href="#cite_ref-MoscowTimes_22-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation news cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20190629085027/https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194">"Western Intelligence Hacked 'Russia's Google' Yandex to Spy on Accounts"</a>. Reuters. June 27, 2019. Archived from <a rel="nofollow" class="external text" href="https://www.themoscowtimes.com/2019/06/27/western-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194">the original</a> on June 29, 2019.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=Western+Intelligence+Hacked+%27Russia%27s+Google%27+Yandex+to+Spy+on+Accounts&rft.date=2019-06-27&rft_id=https%3A%2F%2Fwww.themoscowtimes.com%2F2019%2F06%2F27%2Fwestern-intelligence-hacked-russias-google-yandex-to-spy-on-accounts-a66194&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARegin+%28malware%29" class="Z3988"></span></span> </li> </ol></div>    </div><noscript><img src="https://login.wikimedia.org/wiki/Special:CentralAutoLogin/start?type=1x1" alt="" width="1" height="1" style="border: none; position: absolute;"></noscript> <div class="printfooter" data-nosnippet="">Retrieved from "<a dir="ltr" href="https://en.wikipedia.org/w/index.php?title=Regin_(malware)&oldid=1221434010">https://en.wikipedia.org/w/index.php?title=Regin_(malware)&oldid=1221434010</a>"</div></div> <div id="catlinks" class="catlinks" data-mw="interface"><div id="mw-normal-catlinks" class="mw-normal-catlinks"><a href="/wiki/Help:Category" title="Help:Category">Categories</a>: <ul><li><a href="/wiki/Category:Rootkits" title="Category:Rootkits">Rootkits</a></li><li><a href="/wiki/Category:Computer_access_control" title="Category:Computer access control">Computer access control</a></li><li><a href="/wiki/Category:Privilege_escalation_exploits" title="Category:Privilege escalation exploits">Privilege escalation exploits</a></li><li><a href="/wiki/Category:Cryptographic_attacks" title="Category:Cryptographic attacks">Cryptographic attacks</a></li><li><a href="/wiki/Category:Exploit-based_worms" title="Category:Exploit-based worms">Exploit-based worms</a></li><li><a href="/wiki/Category:2014_in_computing" title="Category:2014 in computing">2014 in computing</a></li><li><a href="/wiki/Category:Hacking_in_the_2010s" title="Category:Hacking in the 2010s">Hacking in the 2010s</a></li><li><a href="/wiki/Category:Spyware_used_by_governments" title="Category:Spyware used by governments">Spyware used by governments</a></li><li><a href="/wiki/Category:Cybercrime_in_India" title="Category:Cybercrime in India">Cybercrime in India</a></li></ul></div><div id="mw-hidden-catlinks" class="mw-hidden-catlinks mw-hidden-cats-hidden">Hidden categories: <ul><li><a href="/wiki/Category:Articles_with_short_description" title="Category:Articles with short description">Articles with short description</a></li><li><a href="/wiki/Category:Short_description_matches_Wikidata" title="Category:Short description matches Wikidata">Short description matches Wikidata</a></li></ul></div></div> </div> </main> </div> <div class="mw-footer-container"> <footer id="footer" class="mw-footer" > <ul id="footer-info"> <li id="footer-info-lastmod"> This page was last edited on 29 April 2024, at 22:43<span class="anonymous-show"> (UTC)</span>.</li> <li id="footer-info-copyright">Text is available under the <a href="/wiki/Wikipedia:Text_of_the_Creative_Commons_Attribution-ShareAlike_4.0_International_License" title="Wikipedia:Text of the Creative Commons Attribution-ShareAlike 4.0 International License">Creative Commons Attribution-ShareAlike 4.0 License</a>; additional terms may apply. By using this site, you agree to the <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use" class="extiw" title="foundation:Special:MyLanguage/Policy:Terms of Use">Terms of Use</a> and <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy" class="extiw" title="foundation:Special:MyLanguage/Policy:Privacy policy">Privacy Policy</a>. Wikipedia® is a registered trademark of the <a rel="nofollow" class="external text" href="https://wikimediafoundation.org/">Wikimedia Foundation, Inc.</a>, a non-profit organization.</li> </ul> <ul id="footer-places"> <li id="footer-places-privacy"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy">Privacy policy</a></li> <li id="footer-places-about"><a href="/wiki/Wikipedia:About">About Wikipedia</a></li> <li id="footer-places-disclaimers"><a href="/wiki/Wikipedia:General_disclaimer">Disclaimers</a></li> <li id="footer-places-contact"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us">Contact Wikipedia</a></li> <li id="footer-places-wm-codeofconduct"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct">Code of Conduct</a></li> <li id="footer-places-developers"><a href="https://developer.wikimedia.org">Developers</a></li> <li id="footer-places-statslink"><a href="https://stats.wikimedia.org/#/en.wikipedia.org">Statistics</a></li> <li id="footer-places-cookiestatement"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement">Cookie statement</a></li> <li id="footer-places-mobileview"><a href="//en.m.wikipedia.org/w/index.php?title=Regin_(malware)&mobileaction=toggle_view_mobile" class="noprint stopMobileRedirectToggle">Mobile view</a></li> </ul> <ul id="footer-icons" class="noprint"> <li id="footer-copyrightico"><a href="https://wikimediafoundation.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/static/images/footer/wikimedia-button.svg" width="84" height="29" alt="Wikimedia Foundation" loading="lazy"></a></li> <li id="footer-poweredbyico"><a href="https://www.mediawiki.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/w/resources/assets/poweredby_mediawiki.svg" alt="Powered by MediaWiki" width="88" height="31" loading="lazy"></a></li> </ul> </footer> </div> </div> </div> <div class="vector-settings" id="p-dock-bottom"> <ul></ul> </div><script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgHostname":"mw-web.codfw.main-694cf4987f-9ffw7","wgBackendResponseTime":208,"wgPageParseReport":{"limitreport":{"cputime":"0.252","walltime":"0.313","ppvisitednodes":{"value":1094,"limit":1000000},"postexpandincludesize":{"value":30167,"limit":2097152},"templateargumentsize":{"value":412,"limit":2097152},"expansiondepth":{"value":8,"limit":100},"expensivefunctioncount":{"value":1,"limit":500},"unstrip-depth":{"value":1,"limit":20},"unstrip-size":{"value":65537,"limit":5000000},"entityaccesscount":{"value":0,"limit":400},"timingprofile":["100.00% 282.359 1 -total"," 62.99% 177.868 1 Template:Reflist"," 37.09% 104.719 6 Template:Cite_news"," 30.95% 87.394 1 Template:Short_description"," 19.39% 54.750 2 Template:Pagetype"," 13.63% 38.479 10 Template:Cite_web"," 6.97% 19.670 3 Template:Main_other"," 6.18% 17.438 1 Template:SDcat"," 2.20% 6.205 1 Template:Cite_magazine"," 0.88% 2.478 1 Template:Short_description/lowercasecheck"]},"scribunto":{"limitreport-timeusage":{"value":"0.150","limit":"10.000"},"limitreport-memusage":{"value":4954712,"limit":52428800}},"cachereport":{"origin":"mw-web.eqiad.main-5dc468848-7ktqn","timestamp":"20241122150635","ttl":2592000,"transientcontent":false}}});});</script> <script type="application/ld+json">{"@context":"https:\/\/schema.org","@type":"Article","name":"Regin (malware)","url":"https:\/\/en.wikipedia.org\/wiki\/Regin_(malware)","sameAs":"http:\/\/www.wikidata.org\/entity\/Q18572753","mainEntity":"http:\/\/www.wikidata.org\/entity\/Q18572753","author":{"@type":"Organization","name":"Contributors to Wikimedia projects"},"publisher":{"@type":"Organization","name":"Wikimedia Foundation, Inc.","logo":{"@type":"ImageObject","url":"https:\/\/www.wikimedia.org\/static\/images\/wmf-hor-googpub.png"}},"datePublished":"2014-11-23T19:28:58Z","dateModified":"2024-04-29T22:43:39Z","headline":"sophisticated malware"}</script> </body> </html>