Red October (malware) explained

Operation Red October or Red October was a cyberespionage malware program discovered in October 2012 and uncovered in January 2013 by Russian firm Kaspersky Lab. The malware was reportedly operating worldwide for up to five years prior to discovery, transmitting information ranging from diplomatic secrets to personal information, including from mobile devices. The primary vectors used to install the malware were emails containing attached documents that exploited vulnerabilities in Microsoft Word and Excel.^{[1] [2]} Later, a webpage was found that exploited a known vulnerability in the Java browser plugin.^[3] Red October was termed an advanced cyberespionage campaign intended to target diplomatic, governmental and scientific research organizations worldwide.

A map of the extent of the operation was released by the Kaspersky Lab – the "Moscow-based antivirus firm that uncovered the campaign."

After being revealed, domain registrars and hosting companies shut down as many as 60 domains, used by the virus creators to receive information. The attackers, themselves, shut down their end of the operation, as well.

The perpetrator of the operation has not been conclusively determined but it appeared to have been in operation on some level since May 2007 at the latest. According to Kaspersky Lab, Russian slang words were found in the code which would be "generally unknown to non-native Russian speakers." However, the program also appeared to be built on existing exploits developed by Chinese hackers and previously used against Tibetan activists.^[4]

Operation Red October Cyber Breaches

Country	Government	Embassy (Diplomatic)	Military	Nuclear / Energy Research	Aerospace	Oil & Gas Industry	Trade and Commerce	Research Institutions	Unknown Victims
	No	Yes	No	No	No	No	No	No	No
	No	Yes	Yes	Yes	No	No	No	Yes	No
	Yes	Yes	Yes	Yes	No	Yes	No	Yes	No
	Yes	Yes	Yes	Yes	Yes	No	No	No	No
	Yes	Yes	No	Yes	No	Yes	No	No	No
	No	Yes	No	Yes	No	Yes	No	Yes	No
	Yes	No	No	Yes	No	Yes	No	No	No
	Yes	Yes	Yes	No	No	No	No	No	No
	Yes	Yes	Yes	No	No	No	No	No	No
	No	Yes	Yes	No	No	No	No	No	No
	Yes	Yes	No	No	No	No	No	No	No
	Yes	Yes	No	No	No	No	No	No	No
	Yes	Yes	No	No	No	No	No	No	No
	Yes	No	No	No	No	No	No	No	No
	Yes	No	No	No	No	No	No	No	No
	Yes	No	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	Yes	No	No	No	No	No	No	No
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes
	No	No	No	No	No	No	No	No	Yes

External links

• Info at kaspersky.com

Notes and References

1. News: Neil . McAllister . . Surprised? Old Java exploit helped spread Red October spyware . 16 Jan 2013.
2. News: . The "Red October" Campaign – An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies . 3 Mar 2014.
3. News: Dan . Goodin . . Red October relied on Java exploit to infect PCs . 15 Jan 2013.
4. News: Zetter . Kim . Cybersleuths Uncover 5-Year Spy Operation Targeting Governments, Others . 25 January 2023 . . January 14, 2013.