Seit September 2013 ist öffentlich belegt, dass NSA und GCHQ vor vier Jahren beim belgischen Telekommunikations-Anbieter Belgacom eingebrochen sind.
Am Sonntag hat der Anti-Viren-Hersteller Symantec einen Bericht über die Malware „Regin“ veröffentlicht:
An advanced piece of malware, known as Regin, has been used in systematic spying campaigns against a range of international targets since at least 2008. A back door-type Trojan, Regin is a complex piece of malware whose structure displays a degree of technical competence rarely seen. Customizable with an extensive range of capabilities depending on the target, it provides its controllers with a powerful framework for mass surveillance and has been used in spying operations against government organizations, infrastructure operators, businesses, researchers, and private individuals.
Außer „kommt wohl von Staaten“ und „zielte auch auf Telekommunikationsunternehmen“ blieb der Bericht jedoch ziemlich oberflächlich.
Morgan Marquis-Boire, Claudio Guarnieri und Ryan Gallagher sprechen jetzt aus, was sich Symantec nicht traut: Secret Malware in European Union Attack Linked to U.S. and British Intelligence
Sources familiar with internal investigations at Belgacom and the European Union have confirmed to The Intercept that the Regin malware was found on their systems after they were compromised, linking the spy tool to the secret GCHQ and NSA operations.
Auch Ronald Prins von der umstrittenen Firma Fox-IT, die den Belgacom-Hack analysiert hat, sagt:
Having analyzed this malware and looked at the [previously published] Snowden documents, I’m convinced Regin is used by British and American intelligence services.
Die Folge:
The implants allowed GCHQ to conduct surveillance of internal Belgacom company communications and gave British spies the ability to gather data from the company’s network and customers, which include the European Commission, the European Parliament, and the European Council. The software implants used in this case were part of the suite of malware now known as Regin.
Die Forscher veröffentlichen ein Sample der Malware (Achtung: infiziert). In den nächsten Wochen wollen sie weitere Details veröffentlichen.