NTC Vulkan

NTC Vulkan (Научно-технический центр «Вулкан», also rendered NTTS VULKAN LLC) is a Russian information-technology and information-security company founded in 2010. On its official website it presents itself as a team of professionals in modern IT and information security that works with businesses, government organizations and public institutions, and states that it helps more than 200 companies protect their business. The company describes three key lines of activity that emerged from its early applied research: cybersecurity, microelectronics, and software development. Its declared service portfolio includes information-security audits, security analysis, OSINT and social engineering, Red Team exercises, security-management systems (ISMS), support for information-security systems, and expert-analytical support for security tools. It highlights expertise in "heavy" security technologies such as SIEM, SOAR, IRP and TIP, and says it has carried out projects in the financial, energy and telecommunications sectors, including preparation for the Sochi Olympics and the FIFA World Cup in Russia. Beyond its public profile as a security integrator, NTC Vulkan has become known internationally through investigative journalism. In January 2023 the Forbidden Stories consortium, working with outlets including The Guardian, Der Spiegel, The Washington Post and Le Monde, published an investigation titled "Spyware for the State" based on a large leak of internal documents (the "Vulkan Files"). The investigation reported that Vulkan, while officially serving banks and insurers, sold surveillance and communications-interception products to authoritarian governments, including China, Saudi Arabia and Kazakhstan, and since 2016 developed offensive cyber tools for Russian intelligence services. Named tools include Amezit, described as a platform for mass creation and management of fake social-media profiles used in disinformation and cyber-influence campaigns, and Skan (Scan-V), a scanning and interception tool. The documents were reported to show links to the FSB, the GRU and its Sandworm hacking unit, and to the Cozy Bear group. The Council of Europe stated on 23 June 2023 that NTTS "VULKAN" LLC is an entity active in the Russian IT sector with a licence issued by the FSB's Centre for Licensing, Certification and Protection of State Secrets. The company reportedly had 135 employees at the beginning of 2023, according to Russian business-information sites. Its main office is in north-east Moscow, with a secondary office in Connecticut in the United States. NTC Vulkan continues to operate and publish news on its website, including partnerships with Russian IT vendors and the launch of a training centre.

NTC Vulkan was founded in 2010 as an expert and integrator in information-security technologies. According to its official "About the company" page, from its first days it included units performing applied research and development in information protection and related areas. Over the following years its development defined three key directions: cybersecurity, microelectronics, and software development. The company built expertise in "heavy" security technologies, with flagship roles assigned to systems such as SIEM, SOAR, IRP and TIP. It reports completing significant projects in the financial, energy and telecommunications sectors, and in preparation for the Sochi Olympics and the FIFA World Cup in Russia, and says it has developed partnerships with leading security-tool developers. Internationally, the company became widely known in January 2023 when the Forbidden Stories consortium, together with The Guardian, Der Spiegel, The Washington Post and Le Monde, published the "Spyware for the State" investigation based on leaked internal documents known as the "Vulkan Files." The reporting alleged that Vulkan, which publicly presented itself as serving banks and insurers, sold products to authoritarian governments including China, Saudi Arabia and Kazakhstan, and that such software could intercept telephone and electronic communications, locate people and access personal data, potentially enabling targeted surveillance of political dissidents, journalists and human-rights activists. The investigation further reported that since 2016 Vulkan created offensive cyber tools for various Russian intelligence services. Among the major tools revealed in 2023 were Amezit, described as a powerful tool for mass creation and management of fake social-media profiles used for cyber-influence and disinformation campaigns, and Skan (Scan-V), a scanning and digital-interception tool used since 2018 to collect large amounts of information about targets in preparation for potential cyberattacks or remote espionage. Internal documents from 2016 to 2021 were reported to show that Vulkan helped Russian intelligence services, in particular the FSB (internal security) and the GRU (military intelligence) and its military unit 74455, the hacker group known as Sandworm, which has been accused of the MacronLeaks influence attempt during the 2017 French presidential election. The leaked documents also reportedly showed links to the Cozy Bear hacking group and more closely to the Rostov-on-Don Radio Research Institute (RNIIRS), considered a key element of the Russian military-industrial complex; Vulkan was reportedly commissioned by the Russian state for the development and manufacture of means of protecting confidential information and for activities involving state secrets. On 23 June 2023 the Council of Europe stated that NTTS "VULKAN" LLC is an entity active in the Russian IT sector with a licence issued by the FSB's Centre for Licensing, Certification and Protection of State Secrets. According to Russian business-information sites, the company had 135 employees at the beginning of 2023. Its main office is in north-east Moscow, with a secondary office in Connecticut in the United States. The company has continued to operate publicly: its website lists services such as information-security audit, security analysis, OSINT and social engineering, Red Team, and security-management systems, and its news section reports ongoing partnerships with Russian IT vendors and the launch of a training centre that received an educational licence in 2026.

• NTC Vulkan officially founded in Russia as an information-security expert and integrator.

• Reported start of development of offensive cyber tools for Russian intelligence services, according to the 2023 Vulkan Files investigation.

• Skan (Scan-V) scanning and interception tool reported in use since 2018.

• Forbidden Stories consortium publishes "Spyware for the State" investigation based on the Vulkan Files leak.

• Council of Europe states NTTS "VULKAN" LLC holds an FSB licence for licensing, certification and protection of state secrets.

• Vulkan's training centre received an educational licence.

Officially positions itself as an expert and integrator in information-security technologies serving business, government and public institutions; investigative reporting describes it as a developer of offensive cyber and surveillance tools for Russian state security services.

• Amezit

  Reported platform for mass creation and management of fake social-media profiles, used for cyber-influence and disinformation campaigns; also reported to detect vulnerabilities in telecom equipment from Huawei, Juniper and Cisco.

• Skan / Scan-V

  Reported scanning and digital-interception tool used since 2018 to collect large amounts of information about targets (infrastructure, departments, employees, vulnerabilities) to prepare cyberattacks or remote espionage.

• LPI/Legend subsystem

  Reported subsystem aimed at concealing the origin of data by deleting or deliberately falsifying metadata.

• Vulkan Files / Spyware for the State investigation

Read more

1. 1НТЦ Вулкан — official websitentc-vulkan.ru
2. 2О компании — NTC Vulkanntc-vulkan.ru
3. 3Услуги — NTC Vulkanntc-vulkan.ru
4. 4Новости — NTC Vulkanntc-vulkan.ru
5. 5NTC Vulkan — Wikidatawikidata.org
6. 6Vulkan (entreprise russe) — Wikipédiafr.wikipedia.org