FBI, CISA, NSA & ODNI Cite Russia in Joint Statement on 'Serious' SolarWinds AttacksFBI, CISA, NSA & ODNI Cite Russia in Joint Statement on 'Serious' SolarWinds Attacks
The attacks appear to be an "intelligence-gathering" mission, the agencies said.
January 6, 2021
The FBI, DHS's Cybersecurity & Infrastrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and National Security Agency (NSA) today issued a joint statement calling the recent SolarWinds breach and attacks on government networks mostly "an intelligence-gathering effort," and citing Russia the likely perpetrator of the attacks.
The nod to Russia bolsters previous public statements by members of Congress, Secretary of State Mike Pompeo, and various security experts who have cited Russia as behind the attacks. Some experts believe it's the handiwork of Russia's SVR intelligence agency.
The so-called Cyber Unified Coordination Group (UCG) task force, made up of the FBI, CISA, and ODNI, with assistance of the NSA, has found less than 10 US government agencies were actually attacked via the breach of SolarWinds' Orion network management software.
"The UCG believes that, of the approximately 18,000 affected public and private sector customers of Solar Winds' Orion product, a much smaller number have been compromised by follow-on activity on their systems," the joint statement said.
UCG said the APT group is "most likely Russian in origin" and behind "most or all" of the recently spotted attacks on government and private-sector networks.
"This is a serious compromise that will require a sustained and dedicated effort to remediate," the agencies said.
Last month CISA revealed that SolarWinds' Orion software wasn't the only initial attack vector: The attackers used other methods as well, which have not yet been publicly disclosed, according to the agency. Meanwhile, last week Microsoft revealed that the SolarWinds attackers had commandeered one of Microsoft's internal accounts to view — but not alter — some of its source code.
Microsoft maintained that its threat-modeling approach mitigates any risk of the exposed code, but experts say questions remain as a full picture emerges of the impact.
Meantime, the NSA is supporting the UCG, Defense Department, Defense contractors, and national security systems with mitigations and assessments of the scope of the attacks, according to the UCG. UCG says it plans to publish indicators of compromise from the attacks as well as any additional information when they become available.
About the Author(s)
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
How to Use Threat Intelligence to Mitigate Third-Party Risk
Everything You Need to Know About DNS Attacks
How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment