The Fallout of Cyberattack on U.S. Continues

The U.S. is grappling with one of its biggest data breaches ever. Yesterday, officials warned that the still-unfolding cyberattack poses “a grave risk to the federal government.”

What we know so far

The hackers, who used multiple attack vectors, are thought to be working at the Kremlin’s behest. They compromised U.S. systems through a supply chain attack on network management company SolarWinds. Over 18,000 private-sector and government users downloaded a corrupted software update from SolarWinds, letting snoopers sniff around for months. They didn’t pursue all 18,000 targets, just the biggest ones.

Last night, Microsoft said it, too, was breached. Intruders leveraged its cloud, a source told Reuters, but aren’t suspected of using Azure services to stage other attacks.

The hackers are also known to have monitored data/emails of the Defense, Commerce, Homeland Security, State, and Treasury Departments. Add the Energy Department and the National Nuclear Security Administration to that list, per a Politico update yesterday. And three states, according to Bloomberg. And the city of Austin, TX, The Intercept reported.

• Important note: Malware was “isolated to business networks only” and didn’t impact U.S. national security, the Energy Department says.

Looking back

The U.S. has invested heavily in beacons and automated detection methods to stop unauthorized federal network visitors in their tracks. Those tripwires weren’t triggered, ranking this attack “among the greatest intelligence failures of modern times,” per the NYT.

Microsoft President Brad Smith said the “latest cyber-assault is effectively an attack on the U.S. and its government and other critical institutions, including security firms.” Nation-state attackers are increasingly sophisticated and augmented by AI, he noted.

What’s next?

It’s not clear what data was accessed or exfiltrated in this sweeping espionage campaign. A full postmortem could take years. In the meantime, former Homeland Security Adviser Tom Bossert recommended that President Trump and President-elect Biden work together to bring the crisis under control.

• “We are sick, distracted, and now under cyberattack. Leadership is essential,” Bossert wrote in the NYT.