One former American intelligence official, who requested anonymity because they are not authorized to discuss classified material, described the relationship between companies like Positive and their Russian intelligence counterparts as “complex” and even “abusive.” The pay is relatively low, the demands are one-sided, the power dynamic is skewed, and the implicit threat for non-cooperation can loom large.

Much of what Positive does for the Russian government’s hacking operations is similar to what American security contractors do for United States agencies.

Privately, the US has concluded that Positive did not just discover and publicize flaws in the system, but also developed offensive hacking capabilities to exploit security holes that were then used by Russian intelligence in cyber campaigns. In a public demonstration for Forbes, Positive showed how it can bypass encryption by exploiting weaknesses in SS7.

One area that’s stood out is the firm’s work on SS7, a technology that’s critical to global telephone networks. But according to previously unreported US intelligence assessments, it also develops and sells weaponized software exploits to the Russian government. The company is open about some of its links to the Russian government, and boasts an 18-year track record of defensive cybersecurity expertise including a two-decade relationship with the Russian Ministry of Defense. The public side of Positive is like many cybersecurity companies: staff look at high-tech security, publish research on new threats, and even have cutesy office signs that read “stay positive!” hanging above their desks.

Russian antivirus kaspersky