Costin Raiu

Early Life and a Teenage Antivirus in Romania

Costin Raiu grew up in Romania with an early interest in electronics, encouraged by his engineer father. After the 1989 Romanian revolution opened the country to imported computers, Raiu got his first PC around 1990 and taught himself programming, starting in Basic and progressing to 8086 assembly language. While still in school, he analyzed a virus known as BadSectors.3428 that had infected his school's network and wrote a disinfection tool for it using assembly code. Word spread, and friends began sending him other viruses to clean.

Working on a 16 MHz 80286 computer, Raiu built on these disinfection tools to create a program he called MScan, which he later renamed RAV (Reliable AntiVirus). Starting in 1994, RAV was distributed commercially through the Romanian company GeCAD, and Raiu worked there as a researcher on the product. In 1996, while looking to exchange virus samples with other researchers, he contacted Eugene Kaspersky, then at AVP; Kaspersky visited him in Bucharest, and the two stayed in touch over the following years.

Joining Kaspersky Lab

Costin Raiu joined Kaspersky Lab in 2000, initially working as a Chief Security Expert overseeing research efforts across Eastern Europe, the Middle East and Africa (EEMEA). Over the following decade he built a reputation as one of the industry's most capable malware analysts, specializing in advanced persistent threats, exploits, and large-scale espionage campaigns.

Leading the Global Research and Analysis Team

In 2010, Raiu became Director of Kaspersky's Global Research and Analysis Team (GReAT), a distributed group of researchers focused on discovering and dissecting the world's most sophisticated malware and nation-state hacking operations. Under his leadership, GReAT grew into one of the most cited sources of APT research in the security industry, publishing detailed technical reports on Securelist, Kaspersky's research blog, and presenting findings at Virus Bulletin, the Security Analyst Summit (SAS), and other industry conferences. Raiu was also a member of the Virus Bulletin Technical Advisory Board and the Computer AntiVirus Researchers' Organization (CARO).

Stuxnet, Duqu, and the Equation Group

GReAT's research under Raiu covered some of the most consequential malware discoveries of the era. The team analyzed Stuxnet, the worm that sabotaged centrifuges at Iran's Natanz nuclear facility, and its related espionage platforms Duqu and Flame. In the spring of 2015, Kaspersky discovered that its own internal network had been compromised by a new malware platform built by the same actor behind the original 2011 Duqu attack; Raiu, as GReAT's director, described the intrusion, dubbed Duqu 2.0, as the work of "one of the most skilled and powerful APT groups," and Kaspersky published the technical findings through Securelist.

In February 2015, Raiu authored the Securelist report "Equation: The Death Star of Malware Galaxy," documenting the Equation Group, an actor GReAT assessed as the most technically sophisticated it had encountered, with tools linking it to prior operations including Stuxnet and Flame.

Carbanak, Moonlight Maze, and Lazarus/BlueNoroff

GReAT under Raiu's direction published research on Carbanak, a cybercriminal campaign that used APT-style techniques to steal from banks and financial institutions worldwide, detailed in the February 2015 Securelist report "The Great Bank Robbery: the Carbanak APT." In April 2017, Raiu and fellow GReAT researcher Juan Andres Guerrero-Saade, working with Thomas Rid and Danny Moore of King's College London, published "Penquin's Moonlit Maze," a nine-month reconstruction of Moonlight Maze, a 1996 intrusion campaign against U.S. military, research, and university networks that is regarded as one of the earliest known state-sponsored cyber-espionage operations. The investigation linked decades-old Moonlight Maze code to a Linux backdoor used by the Turla group. GReAT's later research under Raiu also covered the North Korea-linked Lazarus Group and its financially motivated sub-cluster BlueNoroff.

Departure from Kaspersky and Later Work

On June 16, 2023, Raiu announced on social media that he was leaving Kaspersky after 23 years, writing that it was "half my life dedicated to protecting the world" and that the time was right to look for a new challenge. He subsequently co-founded The Art of Noh, described as a think-tank for advancing cybersecurity research, and TLPBLACK, a boutique cybersecurity consulting and threat-intelligence company offering APT tracking, malware analysis, and digital forensics services. Raiu also became a regular co-host, alongside journalist Ryan Naraine and researcher Juan Andres Guerrero-Saade, of the "Three Buddy Problem" podcast, which discusses nation-state malware, attribution, and the security industry.

Legacy

Over more than two decades, Raiu's work at GReAT shaped how the security industry investigates, names, and attributes nation-state and financially motivated cyber operations. His path from a self-taught antivirus developer in 1990s Romania to director of one of the world's most prominent APT research teams is frequently cited as emblematic of Eastern Europe's outsized role in the malware-research field.

Timeline

• 1994Developed the antivirus program RAV (Reliable AntiVirus), originally called MScan, distributed commercially through the Romanian company GeCAD.
• 1996Began exchanging virus samples with Eugene Kaspersky, who visited him in Bucharest.
• 2000Joined Kaspersky Lab as Chief Security Expert covering the EEMEA region.
• 2010Became Director of Kaspersky's Global Research and Analysis Team (GReAT).
• 2015-02-16GReAT published "The Great Bank Robbery: the Carbanak APT," documenting the Carbanak cybercriminal campaign against banks.
• 2015-03-23Authored the Securelist report "Equation: The Death Star of Malware Galaxy," documenting the Equation Group.
• 2015-06-10Kaspersky disclosed Duqu 2.0, a cyberespionage platform found on its own internal network, with Raiu as GReAT director describing the actor behind it.
• 2017-04-03Published "Penquin's Moonlit Maze" with Juan Andres Guerrero-Saade, Thomas Rid, and Danny Moore, reconstructing the 1996 Moonlight Maze espionage campaign.
• 2023-06-16Announced his departure from Kaspersky after 23 years leading GReAT.
• 2024Co-founded The Art of Noh, a cybersecurity research think-tank, and TLPBLACK, a threat-intelligence consulting company.