FireEye, a Top Cybersecurity Firm, Says It Was Hacked by a Nation-State

WASHINGTON — For years, the cybersecurity firm FireEye has been the first call for government agencies and companies around the world who have been hacked by the most sophisticated attackers, or fear they might be.

Now it looks like the hackers — in this case, evidence points to Russia’s intelligence agencies — may be exacting their revenge.

FireEye revealed on Tuesday that its own systems were pierced by what it called “a nation with top-tier offensive capabilities.” The company said hackers used “novel techniques” to make off with its own toolkit, which could be useful in mounting new attacks around the world.

It was a stunning theft, akin to bank robbers who, having cleaned out local vaults, then turned around and stole the F.B.I.’s investigative tools. In fact, FireEye said on Tuesday, moments after the stock market closed, that it had called in the F.B.I.

The $3.5 billion company, which partly makes a living by identifying the culprits in some of the world’s boldest breaches — its clients have included Sony and Equifax — declined to say explicitly who was responsible. But its description, and the fact that the F.B.I. has turned the case over to its Russia specialists, left little doubt who the lead suspects were and that they were after what the company calls “Red Team tools.”

These are essentially digital tools that replicate the most sophisticated hacking tools in the world. FireEye uses the tools — with the permission of a client company or government agency — to look for vulnerabilities in their systems. Most of the tools are based in a digital vault that FireEye closely guards.

The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention — including FireEye’s — was focused on securing the presidential election system. At a moment that the nation’s public and private intelligence systems were seeking out breaches of voter registration systems or voting machines, it may have a been a good time for those Russian agencies, which were involved in the 2016 election breaches, to turn their attention to other targets.

The hack was the biggest known theft of cybersecurity tools since those of the National Security Agency were purloined in 2016 by a still-unidentified group that calls itself the ShadowBrokers. That group dumped the N.S.A.’s hacking tools online over several months, handing nation-states and hackers the “keys to the digital kingdom,” as one former N.S.A. operator put it. North Korea and Russia ultimately used the N.S.A.’s stolen weaponry in destructive attacks on government agencies, hospitals and the world’s biggest conglomerates — at a cost of more than $10 billion.

The N.S.A.’s tools were most likely more useful than FireEye’s since the U.S. government builds purpose-made digital weapons. FireEye’s Red Team tools are essentially built from malware that the company has seen used in a wide range of attacks.

Still, the advantage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.

“Hackers could leverage FireEye’s tools to hack risky, high-profile targets with plausible deniability,” said Patrick Wardle, a former N.S.A. hacker who is now a principal security researcher at Jamf, a software company. “In risky environments, you don’t want to burn your best tools, so this gives advanced adversaries a way to use someone else’s tools without burning their best capabilities.”

A Chinese state-sponsored hacking group was previously caught using the N.S.A.’s hacking tools in attacks around the world, ostensibly after discovering the N.S.A.’s tools on its own systems. “It’s like a no-brainer,” said Mr. Wardle.

The breach is likely to be a black eye for FireEye. Its investigators worked with Sony after the devastating 2014 attack that the firm later attributed to North Korea. It was FireEye that was called in after the State Department and other American government agencies were breached by Russian hackers in 2015. And its major corporate clients include Equifax, the credit monitoring service that was hacked three years ago, in a breach that affected nearly half of the American population.

In the FireEye attack, the hackers went to extraordinary lengths to avoid being seen. They created several thousand internet protocol addresses — many inside the United States — that had never before been used in attacks. By using those addresses to stage their attack, it allowed the hackers to better conceal their whereabouts.

“This attack is different from the tens of thousands of incidents we have responded to throughout the years,” said Kevin Mandia, FireEye’s chief executive. (He was the founder of Mandiant, a firm that FireEye acquired in 2014.)

But FireEye said it was still investigating exactly how the hackers had breached its most protected systems. Details were thin.

Mr. Mandia, a former Air Force intelligence officer, said the attackers “tailored their world-class capabilities specifically to target and attack FireEye.” He said they appeared to be highly trained in “operational security” and exhibited “discipline and focus,” while moving clandestinely to escape the detection of security tools and forensic examination. Google, Microsoft and other firms that conduct cybersecurity investigations said they had never seen some of these techniques.

FireEye also published key elements of its “Red Team” tools so that others around the world would see attacks coming.

American investigators are trying to determine if the attack has any relationship to another sophisticated operation that the N.S.A. said Russia was behind in a warning issued on Monday. That gets into a type of software, called VM for virtual machines, which is used widely by defense companies and manufacturers. The N.S.A. declined to say what the targets of that attack were. It is unclear whether the Russians used their success in that breach to get into FireEye’s systems.

The attack on FireEye could be a retaliation of sorts. The company’s investigators have repeatedly called out units of the Russian military intelligence — the G.R.U., the S.V.R. and the F.S.B., the successor agency to the Soviet-era K.G.B. — for high-profile hacks on the power grid in Ukraine and on American municipalities. They were also the first to call out the Russian hackers behind an attack that successfully dismantled the industrial safety locks at a Saudi petrochemical plant, the very last step before triggering an explosion.

Security firms have been a frequent target for nation-states and hackers, in part because their tools maintain a deep level of access to corporate and government clients all over the world. By hacking into those tools and stealing source code, spies and hackers can gain a foothold to victims’ systems.

McAfee, Symantec and Trend Micro were among the list of major security companies whose code a Russian-speaking hacker group claimed to have stolen last year. Kaspersky, the Russian security firm, was hacked by Israeli hackers in 2017. And in 2012, Symantec confirmed that a segment of its antivirus source code was stolen by hackers.

David E. Sanger reported from Washington and Nicole Perlroth from San Francisco.