Type: Believed Nation State

Status: Inactive

Other Names:  Rocra

Active Since/Discovered: 2007/ January 2013

Targets: Eastern Europe, former USSR and countries in Central Asia, as well as some countries in Western Europe and North America.

Target Sectors:

• Government entities
• Diplomatic organizations/embassies
• Academia/Research
• Trade and commerce
• Energy, oil and gas companies
• Aerospace
• Military

Malware:

• Rocra Platform/ Red October Platform
  • Included several extensions and malicious files designed to quickly adjust to different system configurations and harvest intelligence from infected machines
  • Capable of stealing data from mobile devices
  • Designed to execute tasks provided by C2 servers, typically as one time PE DLL libraries that are received by server, executed in memory, and then discarded.

Preferred Attack Vector:  Social Engineering and Exploits

IoCs:

• Targeted Windows and Windows Mobile platform

Unique:

• Exploits used by the Rocra malware appear to have been created by Chinese hackers while the malware itself has Russian authors.