Malwarebytes detects leaked tools from FireEye breach

Hello folks! If you have not heard yet, the security firm FireEye has had a breach of many red team assessment tools used for identification of vulnerabilities to help protect customers.

While it is not known exactly who was behind this attack, a big concern is the sharing and use of these stolen red team tools by both sophisticated and non-sophisticated actors, similar to what we saw in 2017 with the ShadowBrokers group breach of the NSA’s Equation Group.

As soon as we at Malwarebytes found out, we started investigating. However, FireEye has been incredibly transparent and released detection rules and code for the stolen tools, so that vendors across the world can protect their customers from these tools.

So, thanks to the diligence of our own threat research team, as well as the transparency and assistance of FireEye, we’ve been able to incorporate these tools into our detection databases so if they show up on your endpoints, we’ll stop them.

Security firms are a huge target for cyber criminals, from FireEye to even us at Malwarebytes.  Often our software is the first, or last line of defense against sophisticated cybercriminal efforts and even state-sponsored attacks.  Being able to compromise one of these organizations has great value for both nation states as well as commercial cybercriminals.

To that end we commend FireEye for their efforts at quickly recovering and reducing the fallout from this breach and support them in protecting both their internal data and customers moving forward, at the end of the day, we are on the same side and have to deal with the same threats.

Thanks for reading, safe surfing.

The post Malwarebytes detects leaked tools from FireEye breach appeared first on Malwarebytes Labs.