Kaspersky Labs published its report on the Equation Group in February 2015. Its “investigation confirmed that Kaspersky Lab has never created any detection of non-weaponized (non-malicious) documents in its products based on keywords like ‘top secret’ and ‘classified.'” Kaspersky goes on to report that it found no evidence of being hacked by Russian spies. The company revealed Duqu 2.0 to the public in 2015. This fits with reports of Israel having burrowed deeply into Kaspersky’s networks. The internal investigation turned up no other third-party intrusion detected in Kaspersky Lab’s networks other than Duqu 2.0. “The archive was not shared with any third parties,” he said. When an analyst told Kaspersky about what was discovered,Kaspersky reportedly said to delete it from their systems. The archive reportedly contained “multiple malware samples and source code for what appeared to be Equation malware.” One file that was detected and automatically uploaded due to KSN being enabled was a 7zip archive. The NSA dude then scanned his computer multiple times, “which resulted in detections of new and unknown variants of Equation APT malware.” The last detection from his machine was on Nov. The NSA worker re-enabled Kaspersky AV at some point, which resulted in the malicious keygen being detected and blocked. The malware dropped from the trojanized keygen was a full blown backdoor which may have allowed third parties access to the user’s machine. The user was infected with this malware for an unspecified period, while the product was inactive. The antivirus was disabled in order for him to run the keygen. Logs indicated that the activation key generator for the 2013 version of Microsoft Office was infected with malware. 11, 2014, after it was automatically submitted due to KSN being enabled on the NSA worker’s computer.Īfter the detection, the NSA worker turned off Kaspersky Lab antivirus in order to install pirated software. According to the preliminary results of Kaspersky Lab’s internal investigation, the Equation malware was first detected Sept.
0 kommentar(er)
