Russian ransomware gang breaches U.S. Energy Department, other federal agencies
The U.S. Department of Energy and several other federal agencies were compromised in a Russian cyber-extortion gang’s global hack of a file-transfer program popular with corporations and governments, but the impact was not expected to be great, Homeland Security officials said Thursday.
But for others among what could be hundreds of victims — including patrons of at least two state motor vehicle agencies — the hack was beginning to show some serious consequences.
Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, told reporters that unlike the meticulous, stealthy SolarWinds hacking campaign attributed to state-backed Russian intelligence agents that was months in the making, this campaign was short, relatively superficial and caught quickly.
“Based on discussions we have had with industry partners ... these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems or to steal specific high-value information. In sum, as we understand it, this attack is largely an opportunistic one,” Easterly said.
“Although we are very concerned about this campaign and working on it with urgency, this is not a campaign like SolarWinds that presents a systemic risk to our national security or our nation’s networks,” she added.
A senior CISA official said neither the U.S. military nor intelligence community was affected. Energy Department spokesperson Chad Smith said two agency entities were compromised, but he did not provide more detail.
Ransomware gangs increasingly use their own or stolen computer code, moving away from a leasing model that made their activities easier to monitor, research shows.
Known victims to date include Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia provincial government in Canada, British Airways, the BBC and the British drugstore chain Boots. The exploited program, MOVEit, is widely used by businesses to securely share files. Security experts say that can include sensitive financial and insurance data.
Louisiana officials said Thursday that people with a driver’s license or vehicle registration in the state likely had their personal information exposed. That included their names, addresses, Social Security numbers and birth dates. They encouraged Louisiana residents to freeze their credit to guard against identity theft.
Russian President Vladimir Putin’s KGB years in East Germany offer a window into his crackdown on protests, war on Ukraine and yearning for empire.
The Oregon Department of Transportation confirmed Thursday that the attackers accessed personal information, some of it sensitive, on about 3.5 million people to whom the state issued identity cards or driver’s licenses.
The Cl0p ransomware syndicate behind the hack announced last week on its dark-web site that its victims, who it suggested numbered in the hundreds, had until Wednesday to get in touch to negotiate a ransom or risk having sensitive stolen data dumped online.
The gang, among the world’s most prolific cybercrime syndicates, also claimed that it would delete any data stolen from governments, cities and police departments. But cybersecurity experts say the Cl0p hackers are not to be trusted to keep their word.
The U.S. is talking cybersecurity this week with 30 countries, but Russia — which some blame for encouraging ransomware attacks — isn’t one of them.
The senior CISA official told reporters that a “small number” of federal agencies were hit — declining to name them — and said that “this is not a widespread campaign affecting a large number of federal agencies.” The official, speaking on condition of anonymity to discuss the breach, said no federal agencies had received extortion demands, and no data from an affected federal agency had been leaked online by Cl0p.
U.S. officials “have no evidence to suggest coordination between Cl0p and the Russian government,” the official said.
The parent company of MOVEit’s U.S. maker, Progress Software, alerted customers to the breach May 31 and issued a patch. But cybersecurity researchers say scores, if not hundreds, of companies could by then have had sensitive data quietly exfiltrated.
Federal officials encouraged victims to come forward, but they often don’t in such cases. The U.S. lacks a federal data-breach law, and disclosure of hacks varies by state. Publicly traded corporations, healthcare providers and some critical infrastructure purveyors do have regulatory obligations to fulfill in the event of a hack.
The cybersecurity firm SecurityScorecard says it detected 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies. It said it was not able to break down those agencies by country.
Microsoft says the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global supply chain.
The Office of the Comptroller of the Currency in the Treasury Department uses MOVEit, according to federal contracting data. Spokeswoman Stephanie Collins said the agency was aware of the hack and has been monitoring the situation closely. She said it was “conducting detailed forensic analysis of system activity and has not found any indications of a breach of sensitive information.”
The hackers were actively scanning for targets, penetrating them and stealing data at least as far back as March 29, said SecurityScorecard threat analyst Jared Smith.
This is far from the first time Cl0p has breached a file-transfer program to gain access to data that it could then use to extort companies. Other instances include GoAnywhere servers in early 2023 and Accellion File Transfer Application devices in 2020 and 2021.
Start your day right
Sign up for Essential California for news, features and recommendations from the L.A. Times and beyond in your inbox six days a week.
You may occasionally receive promotional content from the Los Angeles Times.
