#straitbizarre

[modernismism]

242. Front . . . . . . . #standardsandpraiserepurpose #flameespionage #zerodayexploit #doublefantasy #equationlaser #equationdrug #straitbizarre #patientzero #equestre #grayfish #stuxnet #careto #mask #turla #end

[thetorist]

How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last

Perhaps most costly to the attackers was their failure to renew some of the domains used by these servers. Out of the 300 or so domains used, about 20 were allowed to expire. Kaspersky quickly registered the domains and, over the past ten months, has used them to "sinkhole" the command channels, a process in which researchers monitor incoming connections from Equation Group-infected machines.

One of the most severe renewal failures involved a channel that controlled computers infected by "EquationLaser," an early malware platform abandoned around 2003 when antivirus programs began to detect it. The underlying domain name remained active for years until one day, it didn't; Kaspersky acquired it and EquationLaser-infected machines still report to it.

"It's really surprising to see there are victims around the world infected with this malware from 12 years ago," Raiu said. He continues to see about a dozen infected machines that report from countries that include Russia, Iran, China, and India.