The exploits used in the Red October operation appear to have been created on computers that use Simplified Chinese character encoding, Raiu said. However, there's strong reason to believe that the distributed malware was created by Russian-speaking developers, he said.
It is unclear why the Red October attackers are reusing the Chinese exploits instead of creating their own, but one possibility is that they are attempting to trick investigators into believing that the attacks are associated with other campaigns, Raiu said.
Despite the fact that these exploits are known, some antivirus products don't detect them because they have been slightly modified to evade detection. It's also possible that other methods of distributing the malware are used, but they haven't been identified yet, Raiu said.
The malware installed on computers can download and execute additional encrypted modules, each with its own specific functionality. More than 1,000 modules have been identified so far by the Kaspersky researchers.
Once a system is infected, the attackers spend a few days performing reconnaissance by using different modules to gather information from the system such as, for instance, what applications are installed, what USB devices are attached, the browser history, the stored FTP and email credentials, and the available remote shares.
Additional modules are then deployed to steal data from USB drives, including deleted files, download contact lists, call history, calendar entries or SMS messages from connected mobile phones (Windows Mobile, iPhones and Nokia phones are supported); steal emails from local Outlook storage or remote IMAP/POP3 servers; take screenshots and record keystrokes; and more.
There are also modules for so-called "lateral movement" inside the network -- the infection of other systems on the network. These modules can scan for and exploit known vulnerabilities on other systems, download configuration data from routers, access local FTP servers and other types of servers with stolen credentials, and more.
The types of files targeted by the malware include: txt, csv, eml, doc, vsd, sxw, odt, docx, rtf, pdf, mdb, xls, wab, rst, xps, iau, cif, key, crt, cer, hse, pgp, gpg, xia, xiu, xis, xio, xig, acidcsa, acidsca, aciddsk, acidpvr, acidppr and acidssa.
The acid* files are particularly interesting because they are associated with a classified piece of software called "Acid Cryptofiler" that is used by government organizations to encrypt files and hard drives, Raiu said. Searches on Google will reveal that this software is used by entities like the European Union and NATO, he said.