Who pwns the watchmen? Maybe Russians selling the source code for three US antivirus vendors

Unnamed security shops said to have lost source code

A Russian hacking outfit says it has stolen confidential data from a trio of US antivirus companies.

Security firm Advanced Intelligence (AdvIntel) has "high confidence" in the legitimacy of a posting from hacking group calling itself Fxmsp, which is advertising data and source code from the three unnamed AV companies. AdvIntel said it has already alerted law enforcement.

"Fxmsp is a high-profile Russian and English-speaking hacking collective," AdvIntel said of the group. "They specialize in breaching highly secure protected networks to access private corporate and government information."

AdvIntel says that late last month the group began advertising in various darknet forums that it had obtained network access and source code for the three companies and was selling its purloined loot for the sum of $300,000.

In addition to source code and network access, the group says the 30TB data cache includes documentation about development plans and AI technology as well as information about web security and antivirus products.

Further legitimizing the claim, says AdvIntel, is the fact that the hacking group has been dark for the last several months, indicating the crew was working on something big.

"The actor claimed that antivirus breach research has been their main project over the last six months, which directly correlates with the six-month period during which they were silent on the underground forums where they normally post," the company explains.

"This period started with their seeming disappearance in October 2018 and concluded with their return in April 2019."

While the methods of this intrusion are not yet known, AdvIntel notes that, in the past, Fxmps (who is either a million-dollar "hacking collective" or a guy from Moscow named Andrey, depending on who you ask) has used RDP and Active Directory to get into corporate networks. From there, the hackers harvest and export the data for sale on underground forums.

For companies worried about falling victim to the hacks, the security firm recommends locking down all external-facing RDP and Active Directory machines and keeping source code air-gapped from the main corporate network. ®