A lock icon, signifying an encrypted Internet connection, is seen on an Internet Explorer browser in a photo illustration in Paris April 15, 2014. 
 
 BOSTON Russian hackers exploited a bug in Microsoft Windows and other software to spy on computers used by NATO, the European Union, Ukraine and companies in the energy and telecommunications sectors, according to cyber intelligence firm iSight Partners. 
 
 ISight said it did not know what data had been found by the hackers, though it suspected they were seeking information on the Ukraine crisis, as well as diplomatic, energy and telecom issues, based on the targets and the contents of phishing emails used to infect computers with tainted files. 
 
 The five-year cyber espionage campaign is still going on, according to iSight, which dubbed the operation "Sandworm Team" because it found references to the "Dune" science fiction series in the software code used by the hackers. 
 
 The operation used a variety of ways to attack the targets over the years, iSight said, adding that the hackers began only in August to exploit a vulnerability found in most versions of Windows. 
 
 ISight said it told Microsoft Corp about the bug and held off on disclosing the problem so the software maker had time to fix it. 
 
 A Microsoft spokesman said the company plans to roll out an automatic update to affected versions of Windows on Tuesday. 
 
 There was no immediate comment from the Russian government, NATO, the EU or the Ukraine government. 
 
 Researchers with Dallas-based iSight said they believed the hackers are Russian because of language clues in the software code and because of their choice of targets. 
 
 "Your targets almost certainly have to do with your interests. We see strong ties to Russian origins here," said John Hultquist, head of iSight's cyber espionage practice. The firm plans to release a 16-page report on Sandworm Team to its clients on Tuesday. 
 
 While technical indicators do not indicate whether the hackers have ties to the Russian government, Hultquist said he believed they were supported by a nation state because they were engaging in espionage, not cyber crime. 
 
 For example, in December 2013, NATO was targeted with a malicious document on European diplomacy. Several regional governments in the Ukraine and an academic working on Russian issues in the United States were sent tainted emails that claimed to contain a list of pro-Russian extremist activities, according to iSight. 
 
 The firm said its researchers uncovered evidence that some Ukrainian government computer systems were infected, but they were unable to remotely confirm specific victims among those systems that had been targeted. 
 
 Still, researchers believe a large percentage of those targeted systems were infected because the malicious software used was very sophisticated, using a previously unknown attack method that enabled it to get past virtually all known security protections, said Drew Robinson, a senior technical analyst with iSight Partners. 
 
 ISight said it had alerted some victims of Sandworm Team, but declined to elaborate. 
 
 The iSight research is the latest in a series of private sector security reports that link Moscow to some of the most sophisticated cyber espionage uncovered to date. 
 
 Russia's Kaspersky Lab in August released details on a campaign that attacked two spy agencies and hundreds of government and military targets across Europe and the Middle East. 
 
 (The story corrects spelling of John Hultquist's name in ninth and 10th paragraphs.) 
 
 (Additional reporting by Alastair Macdonald; Editing by Tiffany Wu) ||||| Russian goverment hackers penetrated the Democratic National Committee and had access to the DNC network for about a year, but all were expelled earlier in June. (Jhaan Elker/The Washington Post) 
 
 Russian goverment hackers penetrated the Democratic National Committee and had access to the DNC network for about a year, but all were expelled earlier in June. (Jhaan Elker/The Washington Post) 
 
 Russian government hackers penetrated the computer network of the Democratic National Committee and gained access to the entire database of opposition research on GOP presidential candidate Donald Trump, according to committee officials and security experts who responded to the breach. 
 
 The intruders so thoroughly compromised the DNC’s system that they also were able to read all email and chat traffic, said DNC officials and the security experts. 
 
 The intrusion into the DNC was one of several targeting American political organizations. The networks of presidential candidates Hillary Clinton and Donald Trump were also targeted by Russian spies, as were the computers of some Republican political action committees, U.S. officials said. But details on those cases were not available. 
 
 [Russia denies DNC hack and says maybe someone ‘forgot the password’] 
 
 “I completely rule out a possibility that the [Russian] government or the government bodies have been involved in this,” Dmitry Peskov, the Kremlin’s spokesman, told the Reuters news agency in Moscow. 
 
 1 of 45 Full Screen Autoplay Close Skip Ad × Trump captures the nation’s attention on the campaign trail View Photos The Republican candidate continues to dominate the presidential contest. Caption Businessman Donald Trump officially became the Republican nominee at the party’s convention in Cleveland. Donald Trump speaks at a campaign event at Trump Doral golf course in Miami. Carlo Allegri/Reuters Buy Photo Wait 1 second to continue. 
 
 Some of the hackers had access to the DNC network for about a year, but all were expelled over the past weekend in a major computer cleanup campaign, the committee officials and experts said. 
 
 The DNC said that no financial, donor or personal information appears to have been accessed or taken, suggesting that the breach was traditional espionage, not the work of criminal hackers. 
 
 The intrusions are an example of Russia’s interest in the U.S. political system and its desire to understand the policies, strengths and weaknesses of a potential future president — much as American spies gather similar information on foreign candidates and leaders. 
 
 The depth of the penetration reflects the skill and determination of the United States’ top cyber-adversary as Russia goes after strategic targets, from the White House and State Department to political campaign organizations. 
 
 [Russian hackers breach some White House computers] 
 
 “It’s the job of every foreign intelligence service to collect intelligence against their adversaries,” said Shawn Henry, president of CrowdStrike, the cyber firm called in to handle the DNC breach and a former head of the FBI’s cyber division. He noted that it is extremely difficult for a civilian organization to protect itself from a skilled and determined state such as Russia. 
 
 Donald Trump has repeatedly called Vladimir Putin a "strong" leader, but toes a fine line on praising the Russian president. (Peter Stevenson/The Washington Post) 
 
 “We’re perceived as an adversary of Russia,” he said. “Their job when they wake up every day is to gather intelligence against the policies, practices and strategies of the U.S. government. There are a variety of ways. [Hacking] is one of the more valuable because it gives you a treasure trove of information.” 
 
 Russian President Vladimir Putin has spoken favorably about Trump, who has called for better relations with Russia and expressed skepticism about NATO. But unlike Clinton, whom the Russians probably have long had in their spy sights, Trump has not been a politician for very long, so foreign agencies are playing catch-up, analysts say. 
 
 “The purpose of such intelligence gathering is to understand the target’s proclivities,” said Robert Deitz, former senior councillor to the CIA director and 
 
 a former general counsel at 
 
 the National Security Agency. “Trump’s foreign investments, for example, would be relevant to understanding how he would deal with countries where he has those investments” should he be elected, Deitz said. “They may provide tips for understanding his style of negotiating. In short, this sort of intelligence could be used by Russia, for example, to indicate where it can get away with foreign adventurism.” 
 
 [The not-completely-crazy theory that Russia leaked the Panama Papers] 
 
 Other analysts noted that any dirt dug up in opposition research is likely to be made public anyway. Nonetheless, DNC leadership acted quickly after the intrusion’s discovery to contain the damage. 
 
 “The security of our system is critical to our operation and to the confidence of the campaigns and state parties we work with,” said Rep. Debbie Wasserman Schultz (Fla.), the DNC chairwoman. “When we discovered the intrusion, we treated this like the serious incident it is and reached out to CrowdStrike immediately. Our team moved as quickly as possible to kick out the intruders and secure our network.” 
 
 [Debbie Wasserman Schultz’s Worst Week in Washington] 
 
 Clinton called the intrusion “troubling” in an interview with Telemundo. She also said, “So far as we know, my campaign has not been hacked into,” and added that cybersecurity is an issue that she “will be absolutely focused on” if she becomes president. “Because whether it’s Russia, or China, Iran or North Korea, more and more countries are using hacking to steal our information, to use it to their advantage,” she said. 
 
 A spokeswoman for the Trump campaign referred questions to the Secret Service. 
 
 DNC leaders were tipped to the hack in late April. Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity. 
 
 “It’s never a call any executive wants to get, but the IT team knew something was awry,” ­Dacey said. And they knew it was serious enough that they wanted experts to investigate. 
 
 That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who handled computer crime cases, called Henry, whom he has known for many years. 
 
 Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that it could analyze data that could indicate who had gained access, when and how. 
 
 The firm identified two separate hacker groups, both working for the Russian government, that had infiltrated the network, said Dmitri Alperovitch, CrowdStrike co-founder and chief technology officer. The firm had analyzed other breaches by both groups over the past two years. 
 
 [U.S. suspects Russia in hack of Pentagon computer network] 
 
 One group, which CrowdStrike had dubbed Cozy Bear, had gained access last summer and was monitoring the DNC’s email and chat communications, Alperovitch said. 
 
 The other, which the firm had named Fancy Bear, broke into the network in late April and targeted the opposition research files. It was this breach that set off the alarm. The hackers stole two files, Henry said. And they had access to the computers of the entire research staff — an average of about several dozen on any given day. 
 
 The computers contained research going back years on Trump. “It’s a huge job” to dig into the dealings of somebody who has never run for office before, Dacey said. 
 
 CrowdStrike is not sure how the hackers got in. The firm suspects they may have targeted DNC employees with “spearphishing” emails. These are communications that appear legitimate — often made to look like they came from a colleague or someone trusted — but that contain links or attachments that when clicked on deploy malicious software that enables a hacker to gain access to a computer. “But we don’t have hard evidence,” Alperovitch said. 
 
 The two groups did not appear to be working together, Alperovitch said. Fancy Bear is believed to work for the GRU, or Russia’s military intelligence service, he said. CrowdStrike is less sure of whom Cozy Bear works for but thinks it might be the Federal Security Service, or FSB, the country’s powerful security agency, which was once headed by Putin. 
 
 [How Russian special forces are shaping the fight in Syria] 
 
 The lack of coordination is not unusual, he said. “There’s an amazing adversarial relationship” among the Russian intelligence agencies, Alperovitch said. “We have seen them steal assets from one another, refuse to collaborate. They’re all vying for power, to sell Putin on how good they are.” 
 
 The two crews have “superb operational tradecraft,” he said. They often use previously unknown software bugs — known as “zero-day” vulnerabilities — to compromise applications. In the DNC’s case, the hackers constantly switched tactics to maintain a stealthy presence inside the network and used built-in Windows tools so that they didn’t have to resort to malicious code that might trigger alerts. “They flew under the radar,” Alperovitch said. 
 
 The two groups have hacked government agencies, tech companies, defense contractors, energy and manufacturing firms, and universities in the United States, Canada and Europe as well as in Asia, he said. 
 
 Cozy Bear, for instance, compromised the unclassified email systems of the White House, State Department and Joint Chiefs of Staff in 2014, Alperovitch said. 
 
 “This is a sophisticated foreign intelligence service with a lot of time, a lot of resources, and is interested in targeting the U.S. political system,” Henry said. He said the DNC was not engaged in a fair fight. “You’ve got ordinary citizens who are doing hand-to-hand combat with trained military officers,” he said. “And that’s an untenable situation.” 
 
 Russia has always been a formidable foe in cyberspace, but in the past two years, “there’s been a thousand-fold increase in its espionage campaign against the West,” said Alperovitch, who is also a senior fellow at the Atlantic Council. “They feel under siege.” 
 
 Western sanctions, imposed after Russia’s annexation of Crimea in Ukraine, have hurt the economy and led the government to increase its theft of intellectual property to limit the impact of import restrictions, he said. And Russia’s growing isolation has increased the need for intelligence to understand and influence political decisions in other countries, he added. 
 
 CrowdStrike is continuing the forensic investigation, said Sussmann, the DNC lawyer. “But at this time, it appears that no financial information or sensitive employee, donor or voter information was accessed by the Russian attackers,” he said. 
 
 The firm has installed special software on every computer and server in the network to detect any efforts by the Russian cyberspies to break in again. “When they get kicked out of the system,” Henry predicted, “they’re going to try to come back in.” 
 
 Tom Hamburger contributed to this report. 
 
 Read more: 
 
 Pentagon unveils budget priority for next year: Countering Russia and China 
 
 The Putin-Trump kiss being shared around the world 
 
 Pentagon: U.S. has told Russia where U.S. special forces are in Syria 
 
 FBI wants access to Internet browser history without a warrant in terrorism and spy cases ||||| New research from a Russian computer security company offers good news and bad news for U.S. intelligence agencies. 
 
 On the one hand, the report by Kaspersky Lab appears to reaffirm that U.S. spies can hack into just about anything, including the preprogrammed code that helps a hard drive work. That means the U.S. could, in theory, burrow so deeply into a target's computer that its spyware would remain even if the target reinstalls every piece of consumer software. 
 
 On the other hand, the rest of the world now knows where to look for U.S. computer spies. Spies don't like being found. 
 
 Kaspersky didn’t name the U.S. or any of its agencies in the report. It labeled the hackers the "Equation Group," because of their advanced use of encryption. (The closely held company has a policy not to name the country it thinks is behind a hacking attack.) 
 
 Nonetheless, the report is an unusually detailed look at an apparently American computer espionage operation, traditionally run out of the National Security Agency. 
 
 Kaspersky described the attackers as the most advanced it had ever encountered. Former and current U.S. officials said the tactics described in the report resemble past espionage operations. 
 
 The NSA neither confirmed nor denied involvement. "We are aware of the recently released report,” an agency spokeswoman said. “We are not going to comment publicly on any allegations that the report raises, or discuss any details." 
 
 The tools described in the report were used against governments, telecoms, think tanks and other groups in Iran, Russia, Iraq, Hong Kong and other countries. Kaspersky said networks in the U.S. and U.K. also were targets. 
 
 To be clear, almost all world powers these days use hacker tricks to spy on each other. But the issue has become highly politicized in the U.S. following leaks from Edward Snowden, the former NSA contractor. 
 
 Reports such as Kaspersky’s can make it harder for the U.S. to use the same intelligence tricks. The report also exposed how the U.S. sometimes hides bugs in computer software for years before the software maker fixes them. 
 
 For instance, Kaspersky found evidence that the U.S. sat on a bug in Microsoft software for at least two years before it was revealed in 2010. The bug was patched after security researchers found that a sophisticated worm targeting industrial-control systems, called Stuxnet, used it. Media outlets later reported that Stuxnet was a joint operation between the U.S. and Israel against Iran's nuclear program. 
 
 Kaspersky found the same bug was used in other spying operations as early as 2008. Exploiting such bugs for spying purposes is controversial because, in theory, it leaves other Internet users at risk. 
 
 In this case, U.S. spies coded malware that could install itself into the inner-most level of hard drives made by Western Digital, Samsung Electronics, Seagate Technology, Micron and other major vendors. Such malware would survive even if a target notices something suspicious and reinstalls Windows. 
 
 Kaspersky researchers noted designing spy tools to get to the core of a hard drive would require special access to the drive's source code. Companies in the past have willingly given such information to the NSA. Other times, the U.S. government requires the NSA perform an audit on a vendor's code if a product is going to be used for national-security purposes. 
 
 Western Digital, Seagate and Micron said they had no knowledge of any efforts to use their data-storage devices for intelligence gathering purposes, while stating that they go great lengths to protect the security of their products. 
 
 Seagate has "secure measures to prevent tampering or reverse engineering of its firmware or other technologies," a spokesman for the disk drive maker said. 
 
 Western Digital said it is reviewing the Kaspersky report. "Western Digital has not provided its source code to government agencies," a company spokesman said. 
 
 Samsung could not be reached for comment. 
 
 - Don Clark contributed to this report.
– Microsoft is releasing a patch today to fix a vulnerability in its Windows OS—but not before a cyberespionage campaign against Ukrainian government employees and an American expert on Russia took place. According to the iSight cyberintelligence firm, which discovered the bug last month, hackers sent malicious PowerPoints to users on Windows Vista, 7, or 8, then activated the bug to control users' computers, the Wall Street Journal reports. The hack was part of a larger operation that also spied on NATO, the EU, and energy and telecommunications companies, Reuters reports. iSight doesn't know for sure who's behind the hacking, but it notes that a) one of the hackers is fluent in Russian; b) the Herculean effort suggests a well-supported team (i.e., helped out by a country's government); and c) the targets the hackers went after suggest Russian interests. What worries security experts is that even though there's now a patch to protect against the breach, the hacking world will try to gain access to users' computers before they have a chance to install the fix. "Every criminal and their brother is going to be trying to exploit this flaw in the next few weeks," an ACLU technologist tells the Journal. Perhaps even more mysterious than who's behind the hacking is the information embedded in the software code: iSight says it’s calling the spy operation "Sandworm Team," Reuters notes, because of multiple references found within the hackers' code to Dune—the sandworm was the toothy, desert-dwelling creature featured in the sci-fi movie, book, and TV series. (Chinese hackers accessed personal data for US federal employees earlier this year.)