Using its own forensic analysis, Kaspersky said the breach of the NSA worker’s computer took place between September and November 2014, rather than 2015 as the Journal reported.
Kaspersky said what was stolen included essential source code for some Equation Group malware, as well as classified documents. Based on the materials, it said the computer appeared to belong to someone involved in creating malware for the Equation Group.
The company claimed, however, that the computer was infected by other malware, including a Russian-made “backdoor tool” hidden in Microsoft Office.
Kaspersky said that the malware was controlled from a computer server base in Hunan, China, and would have opened a path into the computer for anyone targeting an NSA worker.
“Given that system owner’s potential clearance level, the user could have been a prime target of nation-states,” it said.
Kaspersky’s own software would have detected that malware, the company said, except that its software had been turned off.
“To install and run this malware, the user must have disabled Kaspersky Lab products on his machine,” it claimed.
Posted by: Dean Alvarez
