Regin

Description

Regin is a sophisticated espionage platform that researchers have linked to state sponsored operations against telecommunications, government, and energy targets. Its modular architecture gave operators surveillance capabilities ranging from password capture to complete remote control, and its low level design and multi stage loading made it one of the most advanced platforms of its era.

Stats

First seen: April 2022
Last seen: October 2026

MITRE ATT&CK techniques

11 techniques across 6 tactics.

TA0005 Stealth

T1036Masquerading
- T1036.001Invalid Code Signature
T1564Hide Artifacts
- T1564.004NTFS File Attributes
- T1564.005Hidden File System

TA0006 Credential Access

T1040Network Sniffing

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
- T1071.002File Transfer Protocols
T1090Proxy
- T1090.002External Proxy
T1095Non-Application Layer Protocol

TA0112 Defense Impairment

T1112Modify Registry

Alert name variants

Alert Name	Engine
Backdoor.Regin.A	AV
Backdoor.Regin.C	AV
Backdoor.Regin.D	AV
Win32.Trojan.Regin	ATP Sandbox Adv. Heuristics

Related families

Cobalt Strike InvisiMole QakBot NETWIRE Anchor