Strider: Cyberespionage group turns eye of Sauron on targets

Symantec describes 'Strider', a low-profile cyberespionage group active since at least 2011 that uses a sophisticated modular backdoor called Remsec to conduct targeted spying (36 infections across 7 organizations in four countries). Remsec components include memory-resident executable blobs, Lua-based modules (network/host loaders and a keylogger referencing “Sauron”), multiple backdoor channels (ICMP/RAW/HTTP/pipes), and capabilities for lateral movement and data exfiltration; Symantec provides detection as Backdoor.Remsec and published IOCs to help defenders.