Cybersecurity firm says U.S. planted spyware in foreign networks

A Russian cybersecurity firm says that the United States has been embedding surveillance and sabotage tools into computers and networks in Iran, Russia, Pakistan, and other countries.

The Kaspersky Lab announced during a conference in Mexico on Monday that the implants had been placed by the "Equation Group," which "appears to be a veiled reference to the National Security Agency and its military counterpart, United States Cyber Command," The New York Times reports. Based on timestamps in affected code, the firm believes the Equation Group has likely been infecting computers since 2001, and increased its efforts in 2008. It also said that infection rates were very high in countries whose nuclear programs are closely monitored by the U.S.

The techniques are similar to Stuxnet, a computer worm that that was operated by the U.S. and Israel that disabled close to 1,000 centrifuges in Iran's nuclear enrichment program. Kaspersky's report said that some of the implants are able to infect the firmware, where it can't be reached by existing antivirus products, and once there, American intelligence agencies can take the encryption keys off the machine and unlock the contents. "If the malware gets into the firmware, it is able to resurrect itself forever," threat researcher Costin Raiu said in the report. "It means that we are practically blind and cannot detect hard drives that have been infected with this malware."

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up