FBI probes Russian-linked postcard sent to FireEye CEO

File photo. CEO of FireEye Kevin Mandia (L) testifies beside former director of the National Security Agency (NSA) retired General Keith Alexander (R), during the Senate Select Committee on Intelligence hearing entitled 'Disinformation - A Primer in Russian Active Measures and Influence Campaigns', on Capitol Hill in Washington, DC, USA, 30 March 2017. [Micheal Reynolds/EPA/EFE]

The FBI is investigating a mysterious postcard sent to the home of cybersecurity firm FireEye’s chief executive days after it found initial evidence of a suspected Russian hacking operation on dozens of US government agencies and private American companies.

US officials familiar with the postcard are investigating whether it was sent by people associated with a Russian intelligence service due its timing and content, which suggests internal knowledge of last year’s hack well before it was publicly disclosed in December.

Moscow has denied involvement in the hack, which US intelligence agencies publicly attributed to Russian state actors.

Suspected Russian hackers spied on US Treasury emails

Hackers believed to be working for Russia have been monitoring internal email traffic at the US Treasury and Commerce departments, according to people familiar with the matter.

The postcard carries FireEye’s logo, is addressed to CEO Kevin Mandia, and calls into question the ability of the Milpitas, California-based firm to accurately attribute cyber operations to the Russian government.

Leading US cybersecurity firm hacked, likely by a government

FireEye, one of the largest cybersecurity companies in the United States, said that it had been hacked, likely by a government, and that an arsenal of hacking tools used to test the defenses of its clients had been stolen.

People familiar with Mandia’s postcard summarized its content to Reuters. It shows a cartoon with the text: “Hey look Russians” and “Putin did it!”

The opaque message itself did not help FireEye find the breach, but rather arrived in the early stages of its investigation. This has led people familiar with the matter to believe the sender was attempting to “troll” or push the company off the trail by intimidating a senior executive.

Reuters could not determine who sent the postcard. US law enforcement and intelligence agencies are spearheading the probe into its origin, the sources familiar said.

The FBI did not provide comment. A FireEye representative declined to discuss the postcard.

A disinformation researcher from the Rand Corporation, Todd Helmus, received a similar postcard in 2019, based on an image of it Helmus posted to Twitter. Helmus, who studies digital propaganda, said he received the postcard after testifying to Congress about Russian disinformation tactics.

FireEye discovered the Russian hacking campaign – now known as “Solorigate” for how it leveraged supply chain vulnerabilities in network management firm Solarwinds – because of an anomalous device login from within FireEye’s network. The odd login triggered a security alert and subsequent investigation, which led to the discovery of the operation.

FireEye worked closely with Microsoft to determine that the infiltration at FireEye in fact represented a hacking campaign that struck at least eight federal agencies including the Treasury, State and Commerce Departments.

When the postcard was sent, FireEye had not yet determined who was behind the cyberattack. A person familiar with the postcard investigation said “this is not typically the Russian SVR’s playbook” but “times are rapidly changing.” SVR is an acronym for the Foreign Intelligence Service of Russia.

A former US intelligence official said the postcard reminded him of a now public mission by US Cyber Command where they sent private messages to Russian hackers ahead of the 2018 congressional elections in the United States.

“The message then from the US was ‘watch your back, we see you’ similar to here,” the former official said.

The extent of the damages tied to the US government hack remains unclear. Emails belonging to senior officials were stolen from an unclassified network at the Treasury and Commerce Departments.

Subscribe to our newsletters

Subscribe
Contribute