Kaspersky Admits: We Obtained Suspected NSA Hacking Code

Russian multinational cybersecurity and anti-virus provider Kaspersky Lab confessed that its security software had taken source code for a secret American hacking tool from a personal computer in the U.S. The company’s statement describes the preliminary results from an internal inquiry it launched into media reports that official Moscow used Kaspersky anti-virus software to collect National Security Agency technology, Reuters reports.

Even though some security experts think that the explanation is reasonable, American officials who were campaigning against using Kaspersky software on sensitive computers will probably take advantage of the admission to justify a ban.

The Department of Homeland Security barred government agencies from using Kaspersky products last month after the warnings from the U.S. authorities prompted by the fears about Kaspersky’s ties to Russian intelligence.

According to the statement, Kaspersky came upon the code in 2014, a year earlier than the recent newspaper reports had it. The logs have showed that the consumer version of Kaspersky’s popular product had been analyzing questionable software from a U.S. computer and found a zip file that was flagged as malicious and one analyst discovered that it contained the secure code for a hacking tool later attributed to what Kaspersky calls the Equation Group. After the Chief Executive Eugene Kaspersky had been informed about the matter, he ordered that the copy of the code to be destroyed. According to the company, no third parties saw the code, but there were reports in the media that the spy tool went into Russian government hands.

The company did not want to inform whether the computer belonged to an NSA worker who took home secret files, like U.S. officials say, but denied the Wall Street Journal report that its programs searched for keyword including “top secret.”

Kaspersky announced its discovery of an espionage campaign by the Equation Group in February 2015 and that fact, according to Reuters,  makes the new 2014 date of the incident intriguing.