121 Pieces of Malware Flagged on NSA Employees Home Computer

Kaspersky Labs internal investigation found a backdoor Trojan and other malware on the personal computer of the NSA employee who took home agency hacking tools.

The personal computer used by the National Security Agency (NSA) employee who reportedly took classified tools from the office and loaded them onto that home machine was infected with a backdoor associated with Russian underground forums. Another 120 pieces of malware were flagged on the machine.
Thats the latest finding of an
internal investigation
published today by Kaspersky Lab, which has been under scrutiny amid allegations that its software assisted Russian nation-state actors in stealing the NSA hacking tools off the employees home computer, which was running Kaspersky Lab antivirus software. The security company has vigorously denied the allegations.
According to the security firms investigation, the NSA employees PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader. The information-stealing backdoor Trojan has been for sale since 2014 in Russian cybercrime underground forums, and from September to November 2011, its command-and-control servers were registered to presumably a Chinese entity going by the name “Zhou Lou”, Kaspersky Labs report says.
The NSA workers machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, and Kaspersky Labs AV later detected the malware as Mokes.
At a later time after installation of the supposed MS Office 2013, the antivirus began blocking connections out on a regular basis to the URL “http://xvidmovies[.]in/dir/index.php”. Looking into this domain, we can quickly find other malicious files that beacon to the same URL. Its important to note that the reason we know the system was beaconing to this URL is because we were actively blocking it as it was a known bad site. This does however indicate the user actively downloaded / installed malware on the same system around the same time frame as our detections on the Equation files, Kaspersky Lab said in
its report
.
To have installed and run the malware in the first place, the victim would have had to disable Kaspersky Labs AV program, the company said.
During the period of September 11 and November 17, 2014, some 121 pieces of malware including Mokes and not including the NSA tools, were flagged by Kaspersky Labs software. The malware included other backdoors, Trojans, adware, and exploits. All of these alerts, combined with the limited amount of available telemetry, means that while we can confirm our product spotted the threats, it is impossible to determine if they were executing during the period the product was disabled, the report says.
The AV operated normally when it flagged the tools created by the Equation Group, Kaspersky Lab says. Equation Group is the moniker the security firm uses for the NSA since it steers clear of attribution of actual attack groups.
In no way was the software used outside of this scope to either pull back additional files that did not fire on a malware signature or were not part of the archive that fired on these signatures, the report says. What is believed to be potentially classified information was pulled back because it was contained within an archive that fired on an Equation specific malware signatures.
The security firm said it found no evidence that its researchers attempted to set up rogue signatures to search for classified or top-secret files on the NSA workers machine.
Given the discovery of the Mokes backdoor infection and possible infections from other malware on the machine, Kaspersky Lab concluded that the data could have been leaked to an unknown number of third-parties as a result of remote access to the computer.
Related Content:
Kaspersky Lab and the AV Security Hole
Russian Hackers Pilfered Data from NSA Contractors Home Computer: Report
Trump Orders Removal of Kaspersky Products from Federal Systems
Insider Threats: Red Flags and Best Practices
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
121 Pieces of Malware Flagged on NSA Employees Home Computer