How Israel caught Russian hackers

NEW YORK: It was a case of spies watching spies watching spies: Israeli intelligence officers looked on in real time as Russian government hackers searched computers around the world for the code names of US intelligence programs.

What gave the Russian hacking, detected more than two years ago, such global reach was its improvised search tool — anti-virus software made by a Russian company, Kaspersky Lab.

The Israeli officials who had hacked into Kaspersky’s own network alerted the US to the intrusion, which has not been previously reported, leading to a decision just last month to order Kaspersky software removed from government computers.

The Russian operation, described by multiple people who have been briefed on the matter, is known to have stolen classified documents from a National Security Agency employee who had improperly stored them on his home computer, on which Kaspersky’s anti-virus software was installed. What additional US secrets the Russian hackers may have gleaned from multiple agencies, by turning the Kaspersky software into a sort of Google search for sensitive information, is not yet publicly known.

The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules. The NSA and the White House declined to comment for this article. The Israeli Embassy declined to comment, and the Russian Embassy did not respond to requests for comment.