Top German official infected by highly advanced spy trojan with NSA ties

German Chancellor Angela Merkel may not be the only high-ranking leader from that country to be spied on by the National Security Agency. According to a report published over the weekend, German authorities are investigating whether the head of the German Federal Chancellery unit had his laptop infected with Regin, a highly sophisticated suite of malware programs that has been linked to the NSA and its British counterpart, the Government Communications Headquarters.

As Ars reported almost 12 months ago, Regin is among the most advanced pieces of malware ever discovered, with dozens of modules that can be used to customize attacks on targets in the telecommunications, hospitality, energy, airline, and research industries. Its technical DNA bears some resemblance to previously discovered state-sponsored malware, including the espionage trojans known as Flame and Duqu, as well as Stuxnet, the computer worm and trojan that the US and Israel reportedly unleashed to disrupt Iran's nuclear program.

According to research published last year by security firm Kaspersky Lab, Regin was used to infect more than 100 targets and has been active since 2008. Kaspersky Lab researchers went on to say that the targets included Belgacom, the partly state-owned Belgian telecom, and Jean-Jacques Quisquater, a prominent Belgian cryptographer. Documents leaked by former NSA subcontractor Edward Snowden have further linked Regin to the NSA, specifically to an NSA attack tool dubbed QWERTY. According to German magazine Der Spiegel, QWERTY is a keylogging plugin that's part of a much larger framework described in Snowden-leaked documents as WARRIORPRIDE. The takeaway is that Regin and WARRIORPRIDE are the same thing.

Kaspersky's investigation in 2014 into Regin is what led the researchers to first come upon The Equation Group, the name Kaspersky has given to a hacker group with NSA ties that operated clandestinely for 14 years before being discovered. The Equation Group is arguably the most sophisticated team of hackers ever to come to light. Its list of almost superhuman technical feats include infecting the firmware of targets' hard drives using two zero-day vulnerabilities later folded into Stuxnet and the ability to use Web redirects to target iPhone users.

Over the weekend, Der Spiegel reported that Regin had been discovered infecting the laptop computer of a head of the Unit of the Federal Chancellery. The Federal Chancellery is the federal agency that serves the office of the Chancellor. The discovery comes after separate documents provided by Snowden in 2013 showed NSA agents eavesdropping on cell phone conversations of Merkel. Prosecutors in Germany investigated the claim but dropped the probe in June, citing insufficient evidence.

The Federal Prosecutor's Office has initiated an investigation into the latest discovery. So far, German officials have provided no timetable for the probe. Revelations that the NSA tapped Merkel's cell phone badly strained German-US relations. The latest discovery, that Germany was further targeted by a sophisticated espionage malware with NSA ties, isn't likely to help the two countries mend that rift.