Major U.S. cybersecurity firm says it was hacked, likely by a foreign government

Prominent U.S. cybersecurity firm FireEye said Tuesday that foreign government hackers with "world-class capabilities" broke into its network and stole offensive tools it uses to probe the defences of its thousands of customers, who include federal, state and local governments and major global corporations.

The attacker targeted and stole assessment tools known as"red team tools" that FireEye uses to test its customers' security and which mimic the methods used by hackers, the company said.

"I've concluded we are witnessing an attack by a nation with top-tier offensive capabilities," FireEye CEO Kevin Mandia said in a statement. "This attack is different from the tens of thousands of incidents we have responded to throughout the years."

Neither Mandianor a FireEye spokespersonsaid who might be responsible or when the company detected the hack.

"I do think what we know of the operation is consistent with a Russian state actor," said former NSA hacker Jake Williams, president of Rendition Infosec. "Whether or not customer data was accessed, it's still a big win for Russia."

No indication stolen tools have been used maliciously

The stolen "red team" tools which amount to real-world malware could be dangerous in the wrong hands. FireEye said there's no indication they have been used maliciously. But cybersecurity experts say sophisticated nation-state hackers could modify them for future use probing vulnerabilities.

The publicly traded company said it developed 300 countermeasures to protect customers and others from them and was making them immediately available.

It is not clear exactly when the hack initially took place, but a person familiar with the events said the company has been resetting user passwords over the past two weeks.

Beyond the tool theft, the hackers also appeared to be interested in a subset of FireEye customers: government agencies.

"We hope that by sharing the details of our investigation, the entire community will be better equipped to fight and defeat cyber attacks," Mandia wrote.

The goal of these operations is typically to collect valuable intelligence that can help them defeat security countermeasures.- Dmitri Alperovitch, CrowdStrike

FireEye was credited with attributing to Russian military hackers mid-winter attacks in 2015 and 2016 on Ukraine's energy grid. The company's top-shelf threat-hunters have alerted government agencies and major companies such as Facebook of malicious campaigns.

FireEye said it is investigating the attack in coordination with the FBI and other partners such as Microsoft, which has its own cybersecurity team. Mandia said the hackers used "a novel combination of techniques not witnessed by us or our partners in the past."

"The FBI is investigating the incident and preliminary indications show an actor with a high level of sophistication consistent with a nation state," said Matt Gorham, assistant FBI director for the Cyber Division.

He said the government is "focused on imposing risk and consequences on malicious cyber actors, so they think twice before attempting an intrusion in the first place."

That has included what the U.S. Cyber Command terms "defending forward" operations, which include penetrating networks of adversaries, including Russia.

The nation's Cybersecurity and Infrastructure Security Agency said Tuesday that it has not received reporting of FireEye's stolen tools being used maliciously, but warned that "unauthorized third-party users could abuse these tools to take control of targeted systems."

Sen. Mark Warner, a Virginia Democrat on the Senate's intelligence committee, applauded FireEye for quickly disclosing the intrusion.

"We have come to expect and demand that companies take real steps to secure their systems, but this case also shows the difficulty of stopping determined nation-state hackers," Warner said in a statement.

Not clear what systems affected

Other security companies have been successfully hacked before, including Bit9, Kaspersky Lab and RSA, underscoring the difficulty in keeping anything digital away from the most sophisticated hackers.

"Plenty of similar companies have also been popped like this," said a Western security official who asked not to be named.

WATCH |Cybersecurity expert explains increase in ransomware attacks:

Ransomware attacks are on the rise. Here's why clicking an email can cost you

4 years ago

Duration 4:38

According to cybersecurity expert Steve Waterhouse, hackers are taking advantage of the health crisis to target hospitals.

"The goal of these operations is typically to collect valuable intelligence that can help them defeat security countermeasures and enable hacking of organizations all over the world," said Dmitri Alperovitch, co-founder and former chief technology officer at top rival CrowdStrike.

FireEye disclosing what happened and which tools were taken, is "helping to minimize the chances of others getting compromised as a result of this breach."

FireEye said it has been working to shore up defences against its own tools with different software makers.

The stolen computer espionage kit targets a myriad of different vulnerabilities in popular software products. It is not yet clear exactly which systems may be affected.

Both NSA and CIA targeted in the past

But Mandia wrote that none of the red team tools exploited so-called "zero-day vulnerabilities," meaning the relevant flaws should already be public.

Past hacking attacks on government agencies and contractors have captured such higher-value hacking tools, and some of those tools have been published, wrecking their effectiveness as defences are put in place.

Both the NSA and CIA have been burned this way in the past decade, with Russia a key suspect. Russian and Iranian tools have been hacked and published more recently. Private surveillance software makers have also been targeted.

Experts said it is hard to estimate the impact of a tool leak that focuses on known software vulnerabilities, but it could make attackers' jobs easier.

"Exploitation tools in the wrong hands will lead to more victimization of people who don't see it coming, and there's already enough problems like that," said Paul Ferguson, threat intelligence principal at security company Gigamon. "We don't really need more exploitation tools floating around making it easier look at ransomware."

Whenever private companies learn of a vulnerability in their software products, they often offer a "patch" or upgrade that nullifies the issue. But many users do not install these patches at once, and some do not for months or longer.

"We are not sure if the attacker intends to use our Red Team tools or to publicly disclose them," Mandia wrote.

Founded in 2004, FireEye went public in 2013 and months later acquired Virginia-based Mandiant Corp., the firm that linked years of cyberattacks against U.S. companies to a secret Chinese military unit. It had about 3,400 employees and $889.2 million US in revenue last year, though with a net loss of $257.4 million. It has reported operating losses each year since its inception, according to its financial filings.

The company's 8,800 customers last year included more than half of the Forbes Global 2000, companies in telecommunications, technology, financial services, healthcare, electric grid operators, pharmaceutical companies and the oil-and-gas industry.