A lock icon, signifying an encrypted Internet connection, is seen on an Internet Explorer browser in a photo illustration in Paris April 15, 2014. 
 
 BOSTON Russian hackers exploited a bug in Microsoft Windows and other software to spy on computers used by NATO, the European Union, Ukraine and companies in the energy and telecommunications sectors, according to cyber intelligence firm iSight Partners. 
 
 ISight said it did not know what data had been found by the hackers, though it suspected they were seeking information on the Ukraine crisis, as well as diplomatic, energy and telecom issues, based on the targets and the contents of phishing emails used to infect computers with tainted files. 
 
 The five-year cyber espionage campaign is still going on, according to iSight, which dubbed the operation "Sandworm Team" because it found references to the "Dune" science fiction series in the software code used by the hackers. 
 
 The operation used a variety of ways to attack the targets over the years, iSight said, adding that the hackers began only in August to exploit a vulnerability found in most versions of Windows. 
 
 ISight said it told Microsoft Corp about the bug and held off on disclosing the problem so the software maker had time to fix it. 
 
 A Microsoft spokesman said the company plans to roll out an automatic update to affected versions of Windows on Tuesday. 
 
 There was no immediate comment from the Russian government, NATO, the EU or the Ukraine government. 
 
 Researchers with Dallas-based iSight said they believed the hackers are Russian because of language clues in the software code and because of their choice of targets. 
 
 "Your targets almost certainly have to do with your interests. We see strong ties to Russian origins here," said John Hultquist, head of iSight's cyber espionage practice. The firm plans to release a 16-page report on Sandworm Team to its clients on Tuesday. 
 
 While technical indicators do not indicate whether the hackers have ties to the Russian government, Hultquist said he believed they were supported by a nation state because they were engaging in espionage, not cyber crime. 
 
 For example, in December 2013, NATO was targeted with a malicious document on European diplomacy. Several regional governments in the Ukraine and an academic working on Russian issues in the United States were sent tainted emails that claimed to contain a list of pro-Russian extremist activities, according to iSight. 
 
 The firm said its researchers uncovered evidence that some Ukrainian government computer systems were infected, but they were unable to remotely confirm specific victims among those systems that had been targeted. 
 
 Still, researchers believe a large percentage of those targeted systems were infected because the malicious software used was very sophisticated, using a previously unknown attack method that enabled it to get past virtually all known security protections, said Drew Robinson, a senior technical analyst with iSight Partners. 
 
 ISight said it had alerted some victims of Sandworm Team, but declined to elaborate. 
 
 The iSight research is the latest in a series of private sector security reports that link Moscow to some of the most sophisticated cyber espionage uncovered to date. 
 
 Russia's Kaspersky Lab in August released details on a campaign that attacked two spy agencies and hundreds of government and military targets across Europe and the Middle East. 
 
 (The story corrects spelling of John Hultquist's name in ninth and 10th paragraphs.) 
 
 (Additional reporting by Alastair Macdonald; Editing by Tiffany Wu) ||||| New research from a Russian computer security company offers good news and bad news for U.S. intelligence agencies. 
 
 On the one hand, the report by Kaspersky Lab appears to reaffirm that U.S. spies can hack into just about anything, including the preprogrammed code that helps a hard drive work. That means the U.S. could, in theory, burrow so deeply into a target's computer that its spyware would remain even if the target reinstalls every piece of consumer software. 
 
 On the other hand, the rest of the world now knows where to look for U.S. computer spies. Spies don't like being found. 
 
 Kaspersky didn’t name the U.S. or any of its agencies in the report. It labeled the hackers the "Equation Group," because of their advanced use of encryption. (The closely held company has a policy not to name the country it thinks is behind a hacking attack.) 
 
 Nonetheless, the report is an unusually detailed look at an apparently American computer espionage operation, traditionally run out of the National Security Agency. 
 
 Kaspersky described the attackers as the most advanced it had ever encountered. Former and current U.S. officials said the tactics described in the report resemble past espionage operations. 
 
 The NSA neither confirmed nor denied involvement. "We are aware of the recently released report,” an agency spokeswoman said. “We are not going to comment publicly on any allegations that the report raises, or discuss any details." 
 
 The tools described in the report were used against governments, telecoms, think tanks and other groups in Iran, Russia, Iraq, Hong Kong and other countries. Kaspersky said networks in the U.S. and U.K. also were targets. 
 
 To be clear, almost all world powers these days use hacker tricks to spy on each other. But the issue has become highly politicized in the U.S. following leaks from Edward Snowden, the former NSA contractor. 
 
 Reports such as Kaspersky’s can make it harder for the U.S. to use the same intelligence tricks. The report also exposed how the U.S. sometimes hides bugs in computer software for years before the software maker fixes them. 
 
 For instance, Kaspersky found evidence that the U.S. sat on a bug in Microsoft software for at least two years before it was revealed in 2010. The bug was patched after security researchers found that a sophisticated worm targeting industrial-control systems, called Stuxnet, used it. Media outlets later reported that Stuxnet was a joint operation between the U.S. and Israel against Iran's nuclear program. 
 
 Kaspersky found the same bug was used in other spying operations as early as 2008. Exploiting such bugs for spying purposes is controversial because, in theory, it leaves other Internet users at risk. 
 
 In this case, U.S. spies coded malware that could install itself into the inner-most level of hard drives made by Western Digital, Samsung Electronics, Seagate Technology, Micron and other major vendors. Such malware would survive even if a target notices something suspicious and reinstalls Windows. 
 
 Kaspersky researchers noted designing spy tools to get to the core of a hard drive would require special access to the drive's source code. Companies in the past have willingly given such information to the NSA. Other times, the U.S. government requires the NSA perform an audit on a vendor's code if a product is going to be used for national-security purposes. 
 
 Western Digital, Seagate and Micron said they had no knowledge of any efforts to use their data-storage devices for intelligence gathering purposes, while stating that they go great lengths to protect the security of their products. 
 
 Seagate has "secure measures to prevent tampering or reverse engineering of its firmware or other technologies," a spokesman for the disk drive maker said. 
 
 Western Digital said it is reviewing the Kaspersky report. "Western Digital has not provided its source code to government agencies," a company spokesman said. 
 
 Samsung could not be reached for comment. 
 
 - Don Clark contributed to this report.
– Microsoft is releasing a patch today to fix a vulnerability in its Windows OS—but not before a cyberespionage campaign against Ukrainian government employees and an American expert on Russia took place. According to the iSight cyberintelligence firm, which discovered the bug last month, hackers sent malicious PowerPoints to users on Windows Vista, 7, or 8, then activated the bug to control users' computers, the Wall Street Journal reports. The hack was part of a larger operation that also spied on NATO, the EU, and energy and telecommunications companies, Reuters reports. iSight doesn't know for sure who's behind the hacking, but it notes that a) one of the hackers is fluent in Russian; b) the Herculean effort suggests a well-supported team (i.e., helped out by a country's government); and c) the targets the hackers went after suggest Russian interests. What worries security experts is that even though there's now a patch to protect against the breach, the hacking world will try to gain access to users' computers before they have a chance to install the fix. "Every criminal and their brother is going to be trying to exploit this flaw in the next few weeks," an ACLU technologist tells the Journal. Perhaps even more mysterious than who's behind the hacking is the information embedded in the software code: iSight says it’s calling the spy operation "Sandworm Team," Reuters notes, because of multiple references found within the hackers' code to Dune—the sandworm was the toothy, desert-dwelling creature featured in the sci-fi movie, book, and TV series. (Chinese hackers accessed personal data for US federal employees earlier this year.)