Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Incident Response

US Still Unraveling ‘Sophisticated’ Hack of 9 Gov’t Agencies

U.S. authorities are still working to unravel the full scope of the likely Russian hack that gave the “sophisticated” actor behind the breach complete access to files and email from at least nine government agencies and about 100 private companies, the top White House cybersecurity official said Wednesday.

U.S. authorities are still working to unravel the full scope of the likely Russian hack that gave the “sophisticated” actor behind the breach complete access to files and email from at least nine government agencies and about 100 private companies, the top White House cybersecurity official said Wednesday.

Anne Neuberger, the newly appointed deputy national security adviser for cyber and emerging technology, also warned that the danger has not passed because the hackers breached networks of technology companies whose products could be used to launch additional intrusions.

A task force is investigating the extent of the damage from the breach, assessing potential responses and trying to confirm the identity of whoever was behind it — a process Neuberger warned will take more time.

“This is a sophisticated actor who did their best to hide their tracks,” she told reporters at the White House. “We believe it took them months to plan and execute this compromise. It will take us some time to uncover this layer by layer.”

U.S. authorities have said the breach, disclosed in December, appeared to be the work of Russian hackers. Neuberger, a former senior official at the National Security Agency who was appointed by President Joe Biden this month, went no further.

“An advanced, persistent threat actor likely of Russian origin was responsible,” she said, without providing any further details and sounding a cryptic note on potential responses.

“This isn’t the only case of malicious cyber activity of likely Russian origin, either for us or for our allies and partners,” Neuberger added. “So, as we contemplate future response options, we are considering holistically what those activities were.”

The Russian government has denied involvement.

Advertisement. Scroll to continue reading.

Private security company FireEye was first to identify the breach, revealing that hackers hijacked widely used network software from SolarWinds Inc. to install malicious software through a what appeared to be a routine security update.

Intelligence agencies did not detect the breach because they largely have “no visibility into private-sector networks,” and it was launched within the U.S., Neuberger said. The Biden administration supports changes to “culture and authorities” that prevented the hack from being detected on the federal civilian systems, she added.

The hack, Neuberger said, highlights the need to modernize the nation’s IT infrastructure and its cyber defenses, issues that will be addressed in an upcoming executive order from Biden aimed at addressing security and technology gaps highlighted by the breach.

Several agencies have acknowledged that they were breached, including the Treasury Department and Justice Department, but the full list has not been publicly released. Once inside, the hackers had full access to the victims’ data.

“The techniques that were used lead us to believe that any files or emails on a compromised network were likely to be compromised,” Neuberger said.

Some members of Congress have criticized the response based on what they have been told so far, all in private. “The briefings we have received convey a disjointed and disorganized response to confronting the breach,” Sen. Mark Warner, a Democrat from Virginia, and Sen. Marco Rubio, Republican from Florida, said in a recent letter to the White House.

Neuberger said she intended to return to the Capitol to brief lawmakers in the coming days.

Continuous Updates: Everything You Need to Know About the SolarWinds Attack

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Coro, a provider of cybersecurity solutions for SMBs, has appointed Joe Sykora as CEO.

SonicWall has hired Rajnish Mishra as Senior Vice President and Chief Development Officer.

Kenna Security co-founder Ed Bellis has joined Empirical Security as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.