Hackers breach US Treasury and Commerce Department. Russians?

Hackers broke into the networks of U.S. federal agencies, including the Treasury and Commerce departments, U.S. officials said Sunday.

Patrick Semansky/AP/File
The U.S. Treasury Department building viewed from the Washington Monument, in 2019, in Washington. Hackers got into computers at the U.S. Treasury Department and possibly other federal agencies officials confirmed Sunday, Dec. 13, 2020

Hackers believed to be working for Russia have been monitoring internal email traffic at the United States Treasury Department and an agency that decides internet and telecommunications policy, according to people familiar with the matter.

There is concern within the U.S. intelligence community that the hackers who targeted Treasury and the Commerce Department’s National Telecommunications and Information Administration used a similar tool to break into other government agencies, according to four people briefed on the matter. The people did not say which other agencies.

Three of the people familiar with the investigation said Russia is currently believed to be behind the attack.

Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.

“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said National Security Council spokesman John Ullyot.

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

The Commerce Department confirmed there was a breach at one of its agencies in a statement. “We have asked the Cybersecurity and Infrastructure Security Agency and the FBI to investigate, and we cannot comment further at this time.”

The breach presents a major challenge to the incoming administration of President-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for. It is not uncommon for large scale cyber investigations to take months or years to complete.

“This is a much bigger story than one single agency,” said one of the people familiar with the matter. “This is a huge cyber espionage campaign targeting the U.S. government and its interests.”

The people did not say which other agencies, but late Sunday Austin, Texas-based IT company SolarWinds said software updates it released in March and June of this year may have been surreptitiously tampered with in a “highly-sophisticated, targeted, and manual supply chain attack by a nation state.”

SolarWinds stopped short of saying the hack at Treasury occurred via them, but two of the people familiar with the investigation said the company was believed to be the channel by which the hackers got in.

A representative for SolarWinds did not immediately return messages seeking comment.

SolarWinds says on its website that its customers include most of America’s Fortune 500 companies, all top ten U.S. telecommunications providers, all five branches of the U.S. military, the State Department, the National Security Agency, and the Office of President of the United States.

Hackers broke into the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.

A Microsoft spokesperson did not immediately respond to a request for comment. Neither did a spokesman for the Treasury Department.

The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

“This is a nation state,” said a different person briefed on the matter.

The full scope of the breach is unclear. The investigation is still its early stages and involves a range of federal agencies, including the FBI, according to three of the people familiar with the matter.

A spokesperson for the Cybersecurity and Infrastructure Security Agency said they have been “working closely with our agency partners regarding recently discovered activity on government networks. CISA is providing technical assistance to affected entities as they work to identify and mitigate any potential compromises.”

The FBI and U.S. National Security Agency did not immediately respond to a request for comment.

There is some indication that the email compromise at NTIA dates back to this summer, although it was only recently discovered, according to a senior U.S. official.

The U.S. government hacks were revealed just days after a major cybersecurity firm disclosed that foreign government hackers had broken into its network and stolen the company’s own hacking tools, reported the Associated Press. Many experts suspect Russia as responsible for the attack against FireEye, a major cybersecurity player whose customers include federal, state and local governments and top global corporations.

Federal government agencies have long been attractive targets for foreign hackers. Hackers linked to Russia were able to break into the State Department’s email system in 2014, infecting it so thoroughly that it had to be cut off from the internet while experts worked to eliminate the infestation.

This story was reported by Reuters. Reuters writers Jack Stubbs and Joseph Menn contributed to this report.

You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.

QR Code to Hackers breach US Treasury and Commerce Department. Russians?
Read this article in
https://www.csmonitor.com/USA/Foreign-Policy/2020/1213/Hackers-breach-US-Treasury-and-Commerce-Department.-Russians
QR Code to Subscription page
Start your subscription today
https://www.csmonitor.com/subscribe