A look at Positive Technologies, a Russian cybersecurity firm sanctioned by the US, which sources say provides hacking tools and ops support for Russian spies

Washington has sanctioned Russian cybersecurity firm Positive Technologies. US intelligence reports claim it provides hacking tools and runs operations for the Kremlin.

MIT Technology Review 2021-04-17 Patrick Howell O'Neill

Context & Ripple Effects

Washington had previously sanctioned Russian firms and individuals over cyberattacks including Russia-linked NotPetya activity. The Positive Technologies action applies that pressure to a cybersecurity vendor alleged to support Kremlin espionage.

The immediate ecosystem response is already uneven: Microsoft has withdrawn Positive Technologies' early access to vulnerability information, while IBM still lists the company as a security partner. That makes vendor trust, rather than sanctions alone, the practical fault line for customers and collaborators.

First-order effects

Positive Technologies loses a key channel into Microsoft's pre-release vulnerability information, limiting its standing within a major security-vendor coordination network.
Microsoft must treat Positive Technologies as outside its trusted vulnerability-sharing circle, while IBM's listed partnership leaves customers facing conflicting institutional signals.

Second-order effects

Security buyers and vendors working with Positive Technologies have stronger reason to reassess whether technical partnerships create exposure to a supplier alleged to support Russian intelligence operations.
Other cybersecurity firms seeking privileged vulnerability access face a clearer incentive to demonstrate separation from state-linked offensive activity as Microsoft defines its trusted-vendor boundary.

Third-order effects

If sanctions and vendor exclusions continue to converge, cybersecurity partnerships may increasingly be governed by a supplier's geopolitical alignment as well as its technical products.
The later US action against China-based Integrity Technology over alleged Flax Typhoon links suggests a broader policy pattern: firms accused of enabling state-backed intrusion activity can become targets of both sanctions and ecosystem isolation.

The trend: Cybersecurity suppliers accused of serving state espionage are increasingly being assessed as geopolitical counterparts, not merely commercial security vendors.

Discussion

@ptsecurity_uk @ptsecurity_uk on x
As a company, we deny the groundless accusations made by the U.S. Department of the Treasury. Geopolitics should not be a barrier to the technological development of society. We will continue to protect and ensure cybersecurity around the world. https://www.ptsecurity.com/... htt…
@nsacyber @nsacyber on x
Russian Foreign Intelligence Service (SVR) cyber actors are exploiting five publicly known vulnerabilities to target U.S. and allied critical networks. Review our joint #cybersecurity guidance with @CISAgov and @FBI and apply the mitigations to stop them: https://www.nsa.gov/... …
@dangoodin001 Dan Goodin on x
.@kimzetter has unearthed a ton of new details about Positive Technologies, the prominent security firm that the US Treasury department sanctioned Thursday on allegations the company assists in the Russian government's hacking of western countries. https://zetter.substack.com/ ..…
@dangoodin001 Dan Goodin on x
@KimZetter The details, laid out in a March 1 report from the Atlantic Council, include techniques PT developed, on behalf of the Russian government, to exploit SS7, the woefully insecure telecommunications protocol that can be abused to intercept calls and texts and to locate us…
@dangoodin001 Dan Goodin on x
@KimZetter Another intriguing detail shows possible links between PT and Equation Group and PT and the Eternal Blue exploit leaked by the Shadow Brokers in 2016. https://t.co/tiTevB53IW
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Positive Technologies refutes the accusations made by US government that the company works with Russian spy agencies. No mention of Russian government in this statement, and most of it is spent touting the company's booming business. https://www.ptsecurity.com/...
@robertcaruso Robert Caruso on x
Too bad. Positive Technologies is lying and Treasury has them dead to rights. Enjoy being sanctioned. https://twitter.com/...
@josephfcox Joseph Cox on x
Russian cybersecurity firm Positive Technologies says in a statement it denies “the groundless accusations made by the U.S. Department of the Treasury.” Yesterday Treasury sanctioned Positive; said the company worked with FSB https://www.ptsecurity.com/... https://twitter.com/...
@josephfcox Joseph Cox on x
Positive Technologies statement also says all zero-day vulnerabilities discovered are disclosed to the impacted vendor https://www.ptsecurity.com/... https://twitter.com/...
@spendergrsec Brad Spengler on x
While this reads like a pretty non-denial denial (more of an advertisement): https://www.ptsecurity.com/... I am sympathetic to the fact that they've been accused (like Kaspersky) of something with no legal recourse to clear their name (https://www.law.uchicago.edu/ ...)
@howelloneill Patrick Howell O'Neill on x
Scoop: Previously unreported US intelligence assessments say Positive Technologies provides hacking tools, knowledge, and operations for the Russian government https://www.technologyreview.com/ ...
@maxbergmann Max Bergmann on x
Second, while the WH did not sanction any oligarchs, it did send a clear message by defining what it sees as Russian interference. For ex, it clearly states that adult children of those interfering are fair game. That has to catch oligarch's attention. 5/ https://www.whitehouse.g…
@dangoodin001 Dan Goodin on x
Moscow-based Positive Technologies is an important security firm that's regularly responsible for the patching of high-severity vulnerabilities that threaten the US. Now Patrick has unearthed evidence it's also a major provider of weaponized exploits to the Russian government. ht…
@dellcam Dell Cameron on x
Scoop by @HowellONeill: Previously unreported US intelligence assessments say Positive Technologies, a cyber firm just sanctioned by U.S. Treasury, is a major provider of “offensive hacking tools, knowledge, and even operations to Russian spies.” https://www.technologyreview.com/…
@hatr Hakan on x
“Positive did not just discover and publicize flaws in the system, but also developed offensive hacking capabilities to exploit security holes that were then used by Russian intelligence in cyber campaigns”, the U.S. has concluded https://www.technologyreview.com/ ...
@saysdana @saysdana on x
I'm so thankful I haven't used Kaspersky software for at least 15 years now. https://twitter.com/...
@ericgeller Eric Geller on x
Quite the scoop here from @HowellONeill on newly sanctioned Russian company Positive Technologies: “[A]ccording to previously unreported US intelligence assessments, it also develops and sells weaponized software exploits to the Russian government.” https://www.technologyreview.c…
@gossithedog Kevin Beaumont on x
Worth looking at when Positive Technologies have been dropping some big enterprise vulns publicly, in terms of US holiday dates. https://twitter.com/...
@howelloneill Patrick Howell O'Neill on x
New: US sanctions against the Russian cybersecurity firm Positive Technologies are privately supported by US intelligence assessments which claim it provides hacking tools and runs operations for the Kremlin. https://www.technologyreview.com/ ...
@tadams0620 T⚉ny Adams on x
Positive Technologies presents an extensive list of Russian government entities in its client list, but only if you are viewing the Russian language version of their site. EN - https://t.co/wA2emIpebU RU - https://t.co/XKXoaGheZe https://t.co/YP0oSCyWTS
@briankrebs @briankrebs on x
One of the 6 Russian tech firms sanctioned yesterday by White House for allegedly aiding Russian cyberspies — Positive Technologies — had advance access to information about vulnerabilities in Microsoft products. MS says it's removed that access for PT https://apnews.com/...
@kimzetter Kim Zetter on x
Positive Technologies, the Russian security firm sanctioned this wk for allegedly helping Russian spies hack the US, has for yrs belonged to Microsoft's MAPP program, which gives security vendors advance access to info about vulns and proof-of-concept code https://t.co/NLhMDalED8
@sherrod_im @sherrod_im on x
This is shocking but I'm glad they found them. https://apnews.com/...
@kennwhite Kenn White on x
This shouldn't be particularly surprising to those who closely follow vulnerability research - several PT principals are well respected by their peers for deeply technical (published) work in Windows core software and x86 management engine/microcode flaws. https://twitter.com/...
@benhawkes Ben Hawkes on x
Not enough. MAPP needs an overhaul. Signature based AVs are a best-effort defense against N-day exploits, and don't provide strategic value. On the other hand, MAPP has consistently been leaking to attackers since inception. The net balance favors attackers at the moment. https:/…
@lcamtuf @lcamtuf on x
Our annual reminder about the perils of vulnerability sharing clubs... https://twitter.com/...
@mattoyeah Matt O'Brien on x
Left: Microsoft's MAPP website showing firms that get early access to vulnerability info; 9:30 p.m. EST Right: Same website, hour later. What's missing? Positive Technologies, now sanctioned by U.S. https://twitter.com/... https://twitter.com/...
@mattoyeah Matt O'Brien on x
That was quick: Microsoft now says it's dropped Russian firm from its MAPP list of companies that get early access to vulnerability info https://twitter.com/... via @fbajak
@dangoodin001 Dan Goodin on x
Last night, @fbajak of the AP reported that Positive Technologies was a member of the Microsoft Active Protections Program, which makes vulnerabilities and sometimes proof-of-concept exploits available in advance of patches being released to the public. https://apnews.com/...
@mattoyeah Matt O'Brien on x
Microsoft names the company, now facing U.S. sanctions, as one of the security software providers to which it gives early access to vulnerability information https://apnews.com/...
@dfriedman33 Dan Friedman on x
In new sanctions on Russia, Treasury bars U.S. banks from lending to key Russian gov institutions. That's a response to actions Russia took while facing (narrower) sanctions. Seems certain US will need better diplomacy too to change Kremlin's behavior. https://home.treasury.gov/.…
@usembassykyiv U.S. Embassy Kyiv on x
Today, the U.S. Department of the Treasury took multiple sanctions actions under new and existing Executive Orders (E.O.) targeting aggressive and harmful activities by the Government of the Russian Federation. https://home.treasury.gov/...
@wylienewmark @wylienewmark on x
I can't recall a previous set of cyber-related sanctions against Russia that goes quite so deep into the public-private overlaps in how Russian intelligence engages in cyber operations. https://home.treasury.gov/...
@iblametom Thomas Brewster on x
Woah - Positive Technologies, a major cybersecurity company in Russia, is one of those targeted by the Biden regime's efforts against Russian cyber activities. The Treasury is saying Positive has been supporting Russian intelligence: https://home.treasury.gov/...
@craigcaplan Craig Caplan on x
April 15, 2021: “Treasury Sanctions Russia with Sweeping New Sanctions Authority” Treasury Secretary Janet Yellen: “The President signed this sweeping new authority to confront Russia's continued and growing malign behavior.” https://home.treasury.gov/...

Chronicles