Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Barr: FBI Probing If Foreign Gov’t Behind HHS Cyber Incident

Attorney General William Barr vowed in an interview with The Associated Press on Tuesday that there would be swift and severe action if a foreign government is behind disinformation campaigns aimed at spreading fear in the U.S. amid the coronavirus pandemic or a denial of service attack on the networks of the Department of Health and Human Services.

Attorney General William Barr vowed in an interview with The Associated Press on Tuesday that there would be swift and severe action if a foreign government is behind disinformation campaigns aimed at spreading fear in the U.S. amid the coronavirus pandemic or a denial of service attack on the networks of the Department of Health and Human Services.

“Our primary role right now is to investigate,” Barr said. “The FBI is very active, trying to determine who is responsible for these things.”

U.S. national security officials said Monday there had been a “cyber incident” involving the computer networks of the Health and Human Services Department, but the networks were operating normally. They didn’t detail the scope of the incident, but HHS Secretary Alex Azar later said the networks were not penetrated and that the department has taken strong defensive action.

A denial of service attack occurs when a perpetrator trying to make a network unavailable to its intended user temporarily disrupts internet connections.

It came just days after federal officials began confronting what they said was a deliberate effort by a foreign entity to sow fears of a nationwide quarantine amid the virus outbreak. Agencies took coordinated action Sunday evening to deny that any such plans were put in place, as they tried to calm a nation already on edge by disruptions to daily life caused by the coronavirus.

Barr told the AP the federal government would take action against anyone who was trying to take advantage of the crisis or against foreign governments that could be trying to spread misinformation and stoke fear or slow down the U.S. response to the virus. He didn’t speculate which government may be behind it.

“When you’re dealing with something like a denial of service attack on HHS during a pandemic, that’s a very grave action for another country to take,” Barr said. “So, if it is another country doing this, I’m sure the ramifications will be severe.”

Rumors about the government’s response to the spreading virus have circulated online for weeks, prompting authorities in several states to urge residents to seek out trusted sources in government and news. Barr said he had not been involved in any conversations and wasn’t aware of any plans for a potential national quarantine.

Advertisement. Scroll to continue reading.

He said there had been “increasing indications of people trying to take advantage of the crisis,” including reports of people selling fake test kits and phony cures.

On Monday, Barr directed U.S. attorneys across the U.S. to prioritize prosecuting all “criminal conduct related to the current pandemic.” In a memo, he warned that the Justice Department had seen reports of people selling fake cures for the coronavirus, phishing emails posing as official notices from the CDC and the World Health Organization and malware inserted in apps designed to track the spread of the virus. Those cases remain under investigation, Barr said.

“Our primary role is really to police the market and make sure people are not taking advantage,” he said.

For most people, the new coronavirus causes only mild or moderate symptoms, such as fever and cough. For some, especially older adults and people with existing health problems, it can cause more severe illness, including pneumonia. The worldwide outbreak has sickened more than 180,000 people and left more than 7,000 people dead. In the United States, there have been more than 4,000 confirmed cases and scores of deaths.

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

Professional services company Slalom has appointed Christopher Burger as its first CISO.

More People On The Move

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Cyberwarfare

An engineer recruited by intelligence services reportedly used a water pump to deliver Stuxnet, which reportedly cost $1-2 billion to develop.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.

Malware & Threats

Cisco is warning of a zero-day vulnerability in Cisco ASA and FTD that can be exploited remotely, without authentication, in brute force attacks.