Positive Technologies: A Wolf in Sheep’s Clothing?

Following the recent sanctions announced by the U.S. Department of the Treasury, Russian cyber-security firm Positive Technologies says the accusations are groundless. The sanctions were announced against six Russian companies and 32 individuals and entities who the U.S. believes help Russian intelligence to conduct cyberespionage and election interference activities. The Biden administration also expelled 10 Russian diplomats.

Positive Technologies, ptsecurity.com/ww-en/ - one of the sanctioned organizations, says it has thousands of customers in 30 countries, including large banks and telecommunications companies, but also lists on its website the Russian government as being one of its customers. The company has, for a long time, been a member of Microsoft's MAPP vulnerability information sharing program, but following the sanctions announcement, Microsoft removed Positive Technologies from the MAPP member list.

MAPP, which stands for the Microsoft Active Protections Program, is run by the Microsoft Security Response Center (MSRC). The program gives partnering security software providers early access to security vulnerability information in advance of Microsoft’s monthly security update. https://www.microsoft.com/en-us/msrc/faqs-mapp

One of the fastest growing companies in the cyber-security field, Positive Technologies has had the Russian government as a client for nearly as long as its 20 years of operation. Having over 1,100 employees, the company now serves government agencies of different countries worldwide. “Over the last five years, our average growth has been 41 percent. We have been regularly rated by international research and advisory agencies as one of the fastest growing visionary companies that develop security and vulnerability management solutions,” a company spokesman noted.

Positive Technologies also points out that it is focused on improving cyber-security around the world, regardless of geopolitical situation, and that it is also open for international cooperation. Its market valuation, the company says, demonstrates high interest in its technologies and the level of trust that customers place in it. “To maintain this trust, we adhere to the principles of maximum openness at all levels of our activities: from research to business, including the company's financial statements,” added the spokesman.

The Russian firm focuses on discovering and reporting vulnerabilities in popular software, to help vendors improve the security of their products. Since 2011, Positive Technologies has been holding Positive Hack Days, a hacking event that attracts thousands each year.

The U.S. believes that Positive Technologies’ Positive Hack Days event is being used by the Russian secret services for recruiting hackers. “We truly think that geopolitics should not be a barrier to the technological development of society and we will continue to do what we do best—to protect and ensure cybersecurity around the world. That is why we continue to work under normal conditions, in full compliance with all of our obligations to our customers, partners, and employees,” per the spokesman.

According to the U.S., the Russian Foreign Intelligence Service (SVR), also known as APT 29, Cozy Bear, and The Dukes, is responsible for exploiting the SolarWinds Orion platform in a cyber-espionage campaign that affected more than 16,000 computer systems worldwide.

Red Sky Alliance has been has analyzing and documenting cyber threats and groups for over 9 years and maintains a resource library of malware and cyber actor reports available at https://redskyalliance.org at no charge. Many past tactics are reused in current malicious campaigns.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com

Weekly Cyber Intelligence Briefings: