Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 12:52:53 UTC
Home > List all groups > List all tools > List all groups using tool Regin
 Tool: Regin
Names
Regin
Prax
WarriorPride
Category Malware
Type Reconnaissance, Backdoor, Info stealer, Tunneling
Description
Regin is a sophisticated malware and hacking toolkit attributed to United States'
National Security Agency (NSA) for government spying operations. It was first publicly
revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. Regin
malware targeted victims in a range of industries, telecom, government, and financial
institutions. It was engineered to be modular and over time dozens of modules have
been found and attributed to this family. Symantec observed around 100 infections in 10
different countries across a variety of organisations including private companies,
government entities, and research institutes.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 23 April 2020
Download this tool card in JSON format
All groups using tool Regin
Changed Name Country Observed
APT groups
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ccaa85ad-0371-471b-9369-9d6d0c0f1bc6
Page 1 of 2

Equation Group 2001-Aug 2016
  GCHQ 1919-2010  
2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ccaa85ad-0371-471b-9369-9d6d0c0f1bc6
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ccaa85ad-0371-471b-9369-9d6d0c0f1bc6
Page 2 of 2