Please ensure Javascript is enabled for purposes of website accessibility
A Russian Ransomware Gang Breaches the Energy Department and Other Federal Agencies
gvw_ap_news
By Associated Press
Published 10 months ago on
June 16, 2023

Share

The Department of Energy and several other federal agencies were compromised in a Russian cyber-extortion gang’s global hack of a file-transfer program popular with corporations and governments, but the impact was not expected to be great, Homeland Security officials said Thursday.

But for others among what could be hundreds of victims from industry to higher education — including patrons of at least two state motor vehicle agencies — the hack was beginning to show some serious impacts.

Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, told reporters that unlike the meticulous, stealthy SolarWinds hacking campaign attributed to state-backed Russian intelligence agents that was months in the making, this campaign was short, relatively superficial and caught quickly.

“Based on discussions we have had with industry partners … these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems, or to steal specific high value information— in sum, as we understand it, this attack is largely an opportunistic one,” Easterly said.

“Although we are very concerned about this campaign and working on it with urgency, this is not a campaign like SolarWinds that presents a systemic risk to our national security or our nation’s networks,” she added.

A senior CISA official said neither the U.S. military nor intelligence community was affected. Energy Department spokesperson Chad Smith said two agency entities were compromised but did not provide more detail.

Known victims to date include Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia provincial government, British Airways, the British Broadcasting Company and the U.K. drugstore chain Boots. The exploited program, MOVEit, is widely used by businesses to securely share files. Security experts say that can include sensitive financial and insurance data.

Louisiana officials said Thursday that people with a driver’s license or vehicle registration in the state likely had their personal information exposed. That included their name, address, Social Security number and birthdate. They encouraged Louisiana residents to freeze their credit to guard against identity theft.

The Oregon Department of Transportation confirmed Thursday that the attackers accessed personal information, some sensitive, for about 3.5 million people to whom the state issued identity cards or driver’s licenses.

The Cl0p ransomware syndicate behind the hack announced last week on its dark web site that its victims, who it suggested numbered in the hundreds, had until Wednesday to get in touch to negotiate a ransom or risk having sensitive stolen data dumped online.

Prolific Cybercrime Syndicate Behind Breach

The gang, among the world’s most prolific cybercrime syndicates, also claimed it would delete any data stolen from governments, cities and police departments.

The senior CISA official told reporters a “small number” of federal agencies were hit — declining to name them — and said “this is not a widespread campaign affecting a large number of federal agencies.” The official, speaking on condition of anonymity to discuss the breach, said no federal agencies had received extortion demands and no data from an affected federal agency had been leaked online by Cl0p.

U.S. officials “have no evidence to suggest coordination between Cl0p and the Russian government,” the official said.

The parent company of MOVIEit’s U.S. maker, Progress Software, alerted customers to the breach on May 31 and issued a patch. But cybersecurity researchers say scores if not hundreds of companies could by then have had sensitive data quietly exfiltrated.

“At this point, we are seeing industry estimates of several hundred of victims across the country,” the senior CISA official said. Federal officials encouraged victims to come forward, but they often don’t. The U.S. lacks a federal data breach law, and disclosure of hacks varies by state. Publicly traded corporations, health care providers and some critical infrastructure purveyors do have regulatory obligations.

The cybersecurity firm SecurityScorecard says it detected 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies. It said it was not able to break down those agencies by country.

The Office of the Comptroller of the Currency in the Treasury Department uses MOVEit, according to federal contracting data. Spokeswoman Stephanie Collins said the agency was aware of the hack and has been monitoring the situation closely. She said it was “conducting detailed forensic analysis of system activity and has not found any indications of a breach of sensitive information.” She would not say how the agency uses the file-transfer program.

The hackers were actively scanning for targets, penetrating them and stealing data at least as far back as March 29, said SecurityScorecard threat analyst Jared Smith.

This is far from the first time Cl0p has breached a file-transfer program to gain access to data it could then use to extort companies. Other instances include GoAnywhere servers in early 2023 and Accellion File Transfer Application devices in 2020 and 2021.

The Associated Press emailed Cl0p on Thursday asking what government agencies it had hacked. It did not receive a response, but the gang posted a new message on its dark web leak site saying: “We got a lot of emails about government data, we don’t have it we have completely deleted this information we are only interested in business.”

Cybersecurity experts say the Cl0p criminals are not to be trusted to keep their word. Allan Liska of the firm Recorded Future has said he is aware of at least three cases in which data stolen by ransomware crooks appeared on the dark web six to 10 months after victims paid ransoms.

RELATED TOPICS:

DON'T MISS

California Man Sentenced to 40 Years to Life for Fatal Freeway Shooting of 6-Year-Old Boy

DON'T MISS

16 Clovis Students Rewarded With Scholarships for Their Resilience

DON'T MISS

Dr. Green Thumb’s Is Open. Sweet Flower Debuts Saturday in Fresno Cannabis Rollout.

DON'T MISS

Reacher Star Alan Ritchson Calls Donald Trump a ‘Rapist’

DON'T MISS

Community Leaders Call for Transparency in Fresno Superintendent Search

DON'T MISS

Israeli Settlers Rampage Through a West Bank Village, Killing 1 Palestinian and Wounding 25

DON'T MISS

US Intelligence Finding Shows China Surging Equipment Sales to Russia to Help War Effort in Ukraine

DON'T MISS

From Tragedy to Triumph: The Land Before Time Litter’s Journey

DON'T MISS

Oakland Officials Vote to Include ‘San Francisco’ in Airport’s Name

DON'T MISS

Several Writers Decline Recognition From PEN America in Protest Over Its Israel-Hamas War Stance

UP NEXT

US Intelligence Finding Shows China Surging Equipment Sales to Russia to Help War Effort in Ukraine

UP NEXT

Convicted Killer of College Student Kristin Smart Attacked at California Prison for Second Time

UP NEXT

Instagram Blurs Nude Messages to Protect Teens, Fight Sexual Extortion

UP NEXT

Ohtani’s Ex-Interpreter Charged With Stealing $16M in Betting Case

UP NEXT

Mom Who Threw 2 Kids Onto LA Freeway, Killing Her Infant, Appeared Agitated by Impending Eclipse

UP NEXT

New Jersey Officials Say They Are Probing Hate Crime After Islamic Center Is Vandalized at Rutgers

UP NEXT

Man Accused of Lighting Fire Outside Bernie Sanders’ Office Had Past Brushes With the Law

UP NEXT

6 Former Mississippi Law Officers Sentenced in State Court for Torture of 2 Black Men

UP NEXT

College Students Are Flocking to the Marriage Pact, Mostly for Fun, but Some Find Lasting Love

UP NEXT

Michigan School Shooter’s Parents Sentenced to 10 Years for Not Stopping a ‘Runaway Train’

Reacher Star Alan Ritchson Calls Donald Trump a ‘Rapist’

2 hours ago

Community Leaders Call for Transparency in Fresno Superintendent Search

2 hours ago

Israeli Settlers Rampage Through a West Bank Village, Killing 1 Palestinian and Wounding 25

5 hours ago

US Intelligence Finding Shows China Surging Equipment Sales to Russia to Help War Effort in Ukraine

5 hours ago

From Tragedy to Triumph: The Land Before Time Litter’s Journey

6 hours ago

Oakland Officials Vote to Include ‘San Francisco’ in Airport’s Name

7 hours ago

Several Writers Decline Recognition From PEN America in Protest Over Its Israel-Hamas War Stance

7 hours ago

US Consumer Sentiment Falls Slightly as Outlook for Inflation Worsens

8 hours ago

A Near-Total Ban on Abortion Has Supercharged the Political Dynamics of Arizona, a Key Swing State

8 hours ago

Convicted Killer of College Student Kristin Smart Attacked at California Prison for Second Time

8 hours ago

California Man Sentenced to 40 Years to Life for Fatal Freeway Shooting of 6-Year-Old Boy

SANTA ANA — A California man was sentenced Friday to 40 years to life for the fatal shooting of a 6-year-old boy who was riding in the back ...

8 mins ago

8 mins ago

California Man Sentenced to 40 Years to Life for Fatal Freeway Shooting of 6-Year-Old Boy

1 hour ago

16 Clovis Students Rewarded With Scholarships for Their Resilience

2 hours ago

Dr. Green Thumb’s Is Open. Sweet Flower Debuts Saturday in Fresno Cannabis Rollout.

2 hours ago

Reacher Star Alan Ritchson Calls Donald Trump a ‘Rapist’

2 hours ago

Community Leaders Call for Transparency in Fresno Superintendent Search

5 hours ago

Israeli Settlers Rampage Through a West Bank Village, Killing 1 Palestinian and Wounding 25

5 hours ago

US Intelligence Finding Shows China Surging Equipment Sales to Russia to Help War Effort in Ukraine

6 hours ago

From Tragedy to Triumph: The Land Before Time Litter’s Journey

MENU

CONNECT WITH US

Search

Send this to a friend