Connect with us

Hi, what are you looking for?



Vermont Utility Refutes Reports of Russia Hacking U.S. Electric Grid

U.S. officials told the press that Russia hacked into the country’s electric grid, but the affected utility said it had only found malware on one device that was not connected to the grid.

U.S. officials told the press that Russia hacked into the country’s electric grid, but the affected utility said it had only found malware on one device that was not connected to the grid.

The Washington Post on Saturday cited anonymous U.S. officials claiming that Russian hackers breached the electric grid. The article, titled “Russian hackers penetrated U.S. electric grid through a utility in Vermont,” led to several politicians making alarming statements on Russia and hackers.

The Vermont utility referenced by The Washington Post, the Burlington Electric Department, published a statement refuting the claims.

Last week, just as the Obama administration announced retaliation against Russia over the presidential election cyberattacks, the DHS and the FBI published a Joint Analysis Report (JAR) to detail the tools and infrastructure used by Russian civilian and military intelligence services in attacks aimed at networks and endpoints associated with the election and various other government, political, and private sector entities.

This malicious activity, dubbed by the U.S. government “Grizzly Steppe,” included attacks launched by two well-known Russia-linked threat groups tracked as APT28 (aka Fancy Bear, Pawn Storm, Strontium, Sofacy, Sednit and Tsar Team) and APT29 (aka Cozy Bear and CozyDuke).

However, security experts have criticized the U.S. government for failing to provide strong evidence that Russia did in fact attempt to interfere with the presidential election. Furthermore, some warned that the indicators of compromise (IoC) provided in the JAR are low quality and could lead to false positives.

After the Grizzly Steppe report was published, Burlington Electric conducted a scan of all its computers in an effort to determine if any devices had been infected with Grizzly Steppe malware. Suspicious Internet traffic was detected on a single computer, which had not been connected to the electric grid.

Advertisement. Scroll to continue reading.

“There is no indication that either our electric grid or customer information has been compromised,” the Vermont utility stated. “Media reports stating that Burlington Electric was hacked or that the electric grid was breached are false.”

“Federal officials have indicated that this specific type of Internet traffic also has been observed elsewhere in the country and is not unique to Burlington Electric. It’s unfortunate that an official or officials improperly shared inaccurate information with one media outlet, leading to multiple inaccurate reports around the country,” it added.

The Washington Post has rewritten its story, clarifying that authorities had not actually found any evidence that the grid had been breached. However, experts say even the new headline, “Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security,” is FUD.

On the other hand, many experts believe the U.S. power grid is vulnerable to cyberattacks.

“Based on existing intelligence, it is reasonable to assume that nation-states already possess all the information they need to launch such an attack on the U.S. power grid – they choose not to because of political implications,” Tim Layton, chief intelligence officer at SurfWatch Labs, said in a SecurityWeek column. “I also believe the USA possesses the same capabilities. It isn’t just nation-states that we need to be concerned with, as radical terrorist groups are highly motivated to bring harm to the American people and economy.”

While there is no evidence of destructive cyberattacks on the U.S. electric grid, such attacks have been launched in Ukraine. The Russian government is believed to be responsible for the December 2015 attack that caused severe power outages, and a recent incident may have also been caused by a cyberattack.

Related: Trump to Meet U.S. Spy Chiefs to Get Russian Hacking ‘Facts’

Related: Spies and Hackers – Russians Sanctioned by US

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet