Report: Fxmsp, a collective of Russian- and English-speaking hackers, is selling source code and network access to three US-based antivirus software vendors
Source code, network access being sold online by “Fxmsp” collective. — In a report published Thursday, researchers …
Context & Ripple Effects
Selling breached source code at auction has a lineage: the online auction of malware allegedly from the NSA-linked Equation Group in 2016, followed by Kaspersky's detailed account of how it obtained Equation Group source code. The Fxmsp report extends that playbook from government stockpiles to commercial security vendors themselves.
The named targets — Symantec, Trend Micro, and McAfee per Fxmsp's claims — are the companies customers rely on to detect intrusions, which is what makes alleged sales of their source code and network access more consequential than an ordinary breach. Days later, Symantec denied being impacted and disputed the researchers' account, while Trend Micro called it a low-risk incident.
First-order effects
- Symantec, Trend Micro, and McAfee face immediate pressure to verify or refute Fxmsp's breach claims while their detection signatures and internal networks are reportedly on sale — Symantec's public denial and Trend Micro's 'low risk' framing show each vendor managing disclosure on its own terms.
- Buyers of the listings gain potential visibility into how major antivirus products detect threats, degrading the very tooling enterprises use against the sellers' ecosystem.
Second-order effects
- Enterprise customers of the three vendors must weigh whether their endpoint protection can be trusted if the code behind it circulates among attackers, forcing reassurance campaigns and potentially shifting procurement toward vendors with cleaner breach records.
- A functioning resale market for pre-built network access lowers the barrier for less-skilled groups to hit corporate targets, expanding demand beyond Fxmsp's own operations.
Third-order effects
- If source code and network access keep trading as commodities — from the Equation Group leaks to this sale — breaches stop being endpoints and become inventory, structurally favoring brokers who aggregate and resell access.
- The eventual [[a:955488|unsealing of court documents identifying Fxmsp as a Kazakh hacker tied to thefts at 300+ organizations across 44 countries]] shows law enforcement eventually attaching names to these collectives, but identification lagged the sales by over a year.
The trend: Stolen source code and corporate network access are consolidating into a brokered underground market where security vendors themselves are inventory.