The Kaspersky Global Research and Analysis Team discovered the Equation Group, which uses tools like EquationLaser and Fanny to infect victims. This team found that the group uses modules to reprogram hard drive firmware, which allows the malware to survive disk formatting. I see the US ban as a blow to a company that grew to 822 million dollars in annual revenue by 2024. The company’s history started in 1997 when Eugene Kaspersky, Natalya Kaspersky, and Alexey De-Monderik left KAMI to form the firm. In 1998, Kaspersky’s AVP software was the only tool able to remove the CIH virus, which led to deals in Japan, Finland, and Germany. The company’s revenue grew 280 percent from 1998 to 2000. By 2000, the company had 65 employees and sales in more than 40 countries. In 2011, General Atlantic bought a 20 percent share of Kaspersky Lab for 200 million dollars. The company reached 400 million users in 2016 and analyzed more than 350,000 malware samples per day. In 2016, the software held a large market share in Europe. In 2016, executive Ruslan Stoyanov was arrested by Russian authorities. In 2023, many of the company’s senior staff and managers were hit by an attack that compromised thousands of iPhones. The Equation Group uses a vast C&C infrastructure that includes more than 300 domains and more than 100 servers.
Regulatory details and global fallout
The US Department of Commerce added three Kaspersky entities to the Entity List, including two in Russia and one in the UK. The Treasury Department also sanctioned twelve senior executives through the Office of Foreign Assets Control. These actions rely on the National Defense Authorization Act and the Federal Acquisition Regulation to manage national security risks. The Bureau of Industry and Security determined that the software operates at the kernel level and can collect sensitive information like IP addresses, physical locations, hardware information, and user account names. The US government asserts that the company remains subject to the direction of the Russian government.
| Regulatory Milestone | Date | Scope |
|---|---|---|
| New Agreement Ban | July 20, 2024 | No new agreements with US persons |
| Update/KSN Ban | September 29, 2024 | No signature or codebase updates in US |
| Sales Ban | September 29, 2024 | No reselling or licensing in US |
The ban prevents the sale of Kaspersky products and the provision of updates to US users. In September 2024, the software replaced itself with UltraAV on US computers without notifying users of the exact timing. This sudden replacement of software with a product from the US firm Pango caused substantial frustration for many users. The US government gave users a 100-day transition period to find alternatives before the ban took effect. I note that the impact on global usage has been extreme. In Germany, Kaspersky usage dropped by 69 percent between April and November 2024. While the ban is active, over 1,000 US organizations still communicated with Kaspersky update servers in late 2024.
The rivalry and market share
CrowdStrike Falcon is a primary alternative for businesses needing endpoint security. In 2026, over 3,323 companies have used CrowdStrike Falcon. Its market share in the endpoint security market is 2.63 percent.
| Competitor | Market Share |
|---|---|
| Sophos | 20.55% |
| Trend Micro | 11.65% |
| WatchGuard | 7.70% |
| Microsoft Defender | 7.27% |
Most CrowdStrike customers belong to companies with 10,000 or more employees. The United States is the largest market for these customers, representing 68.06 percent of the user base. The top three products for customers using CrowdStrike are Cybersecurity with 131 customers, Managed Services with 120, and Cloud Services with 118. I find the scale of CrowdStrike’s US presence in 2026, with 1,926 customers in the country, makes it a formidable opponent. The company sells 29 cloud modules via a subscription model. You must verify your own endpoint security to ensure compliance with US laws. Why did Kaspersky fail to manage the transition to UltraAV more smoothly?
