Skip the navigation

Diplomatic and government agencies targeted in years-long cyberespionage operation

By Lucian Constantin
January 14, 2013 01:51 PM ET

The Red October attackers spend a couple of days gathering information about an infected system and its network before deciding which modules to use and how. The attacks are more personal and the level of customization is greater, Raiu said.

The operation's command-and-control infrastructure is also sophisticated. The Kaspersky researchers discovered more than 60 domain names used for command-and-control purposes that are hosted on servers in Russia, Germany and other countries. The whole infrastructure is actually a chain of servers that act as proxies to hide the main and yet-to-be-identified "mothership" server, they said.

Given the length of the operation, the Kaspersky researchers believe that hundreds of terabytes of sensitive data have probably been stolen until now.

Raiu declined to name any of the affected organizations, but said that the company is open to working with the national CERTs (computer emergency response teams) from countries where victims were identified and provide them with the IP (Internet protocol) addresses of the victims.

Reprinted with permission from IDG.net. Story copyright 2014 International Data Group. All rights reserved.
Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!