Hackers Breach Kaspersky Endpoint Security and Leak Source Code

Recent high‑profile cyber‑attacks have targeted major tech companies, with a South American hacker group compromising Nvidia and Samsung for non‑political motives, while another group, NB65, launched a politically motivated intrusion that exposed Kaspersky’s security defenses.

On February 28, 2022, NB65 attacked the Russian Nuclear Safety Research Institute and a Russian telecom autonomous system that hosts numerous government and military information systems. The breach resulted in the theft of more than 40,000 documents, some classified as confidential.

Among the stolen data, the hackers discovered that many Russian government departments were using Kaspersky Endpoint Security, indicating that the attackers had successfully bypassed Kaspersky’s own protection mechanisms. Unaware of the significance, NB65 later realized that portions of Kaspersky’s endpoint security source code were also present in the compromised system.

NB65 announced on Twitter that it would publish the Kaspersky source code within 12 hours. While the exact components remain unclear, it is believed that the leaked material pertains to Kaspersky Endpoint Security rather than the company’s antivirus products.

As of the article’s publication (2022‑03‑10 18:50 UTC+8), the security site BluePoint has observed TOR‑hosted sites offering downloads of files containing Kaspersky‑related keywords, though the authenticity of these files has not yet been verified, and Kaspersky’s official labs have not responded.