Positive Technologies, the Russian security firm sanctioned this wk for allegedly helping Russian spies hack the US, has for yrs belonged to Microsoft's MAPP program, which gives security vendors advance access to info about vulns and proof-of-concept code zetter.substack.com/p/sanctioned-f…
Although the allegations against Positive Technologies cited by the Treasury Dept were vague, a little-seen report published by the Atlantic Council last month appears to provide much more detail about the activities that may have led to the sanctions against the company.
That report doesn't name Positive Technologies at all, instead it uses a code name - ENFER - to refer to a Russian security firm aiding Russian spies. ENFER has allegedly reversed/repurposed malicious code found on Russian gov networks to create exploits for other intrusions.
ENFER also allegedly created exploits for SS7. It developed the techniques while performing security defensive services for a prominent Russian telecom client. The techniques were then used on other telecom networks including in Middle East and provided to other state services.
According to report, ENFER offers legit code-auditing services, pen-testing, vuln research and threat intel to corporate/gov clients, while giving weaponized exploits to Russian gov. The work is done “in response to direct tasking by officers of the FSB on specific projects"
The work ENFER does for the FSB allegedly includes development of offensive tools for conducting system and network reconnaissance and exfiltrating documents, infrastructure engineering, and even managing command and control servers.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
