US cybersecurity firm FireEye says it was hacked by foreign government
FireEye, one of the largest cybersecurity companies in the US, said on Tuesday that foreign government hackers with “world-class capabilities” broke into its network and stole tools it uses to test the defenses of its thousands of customers, who include federal, state and local governments and major global corporations.
The hackers “primarily sought information related to certain government customers”, said FireEye’s CEO, Kevin Mandia, in a statement, without naming them. He said there was no indication the hackers got customer information from the company’s consulting or incident-response businesses or threat intelligence data it collects.
“I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities,” Mandia said, deeming it “different from the tens of thousands of incidents we have responded to throughout the years”.
The hack of FireEye, a company with an array of business contracts across the national security space in the US and among its allies, is among the most significant breaches in recent memory.
“I do think what we know of the operation is consistent with a Russian state actor,” said the former NSA hacker Jake Williams, president of Rendition Infosec. “Whether or not customer data was accessed, it’s still a big win for Russia.”
The FireEye breach was disclosed in a blogpost authored by Mandia. The post said “red team tools” were stolen as part of a highly sophisticated operation. It is not clear exactly when the hack initially took place.
Beyond the tool theft, the hackers also appeared to be interested in a subset of FireEye customers: government agencies.
“We hope that by sharing the details of our investigation, the entire community will be better equipped to fight and defeat cyber-attacks,” Mandia wrote.
The company itself has partnered in recent weeks with different software makers to share defensive measures.
There is no evidence yet that FireEye’s hacking tools have been used or that client data was exfiltrated. But the investigation, which includes help from the FBI and Microsoft, is in its early phases.
“This incident demonstrates why the security industry must work together to defend against and respond to threats posed by well-funded adversaries using novel and sophisticated attack techniques,” a Microsoft spokesperson said.
The FBI did not immediately respond to a request for comment.
The stolen computer espionage kit targets a myriad of different vulnerabilities in popular software products. It is not yet clear exactly which systems may be affected.
But Mandia wrote that none of the red team tools exploited so-called “zero day vulnerabilities”, meaning the relevant flaws should already be public.
Experts say it can be difficult to measure the impact of a hacking tool leak which focuses on known software vulnerabilities. When a private company becomes aware of a vulnerability in their software product, they often try to offer a “patch” or upgrade that nullifies the issue. Yet users do not always download these patches quickly, leaving themselves exposed for months or weeks.
“We are not sure if the attacker intends to use our Red Team tools or to publicly disclose them,” Mandia wrote.
Mark Warner, the Democratic vicechairman of the Senate select committee on intelligence, said: “The hack of a premier cybersecurity firm demonstrates that even the most sophisticated companies are vulnerable to cyber-attacks.
“We have come to expect and demand that companies take real steps to secure their systems, but this case also shows the difficulty of stopping determined nation-state hackers. As we have with critical infrastructure, we have to rethink the kind of cyber assistance the government provides to American companies in key sectors on which we all rely.”
Based in Milpitas, California, FireEye has been at the forefront of investigating state-backed hacking groups, including Russian groups trying to break into state and local governments in the US that administer elections.
FireEye was credited with attributing to Russian military hackers midwinter attacks in 2015 and 2016 on Ukraine’s energy grid. The company’s top-shelf threat-hunters have alerted government agencies and large companies such as Facebook of malicious campaigns.