A Russian ransomware gang breaches the Energy Department and other federal agencies

Russian ransomware gang breaches Energy Department and federal agencies

The Energy Department and several federal agencies fell victim to a cyber-extortion attack by a Russian ransomware gang, which exploited a widely-used file-transfer program popular among corporations and governments. Despite concerns, officials from Homeland Security reassured the public that the impact of the breach was expected to be minimal.

The consequences of the attack started to become evident, affecting not only the federal agencies but also patrons of two state motor vehicle agencies.

During a press briefing, Jen Easterly, the director of the Cybersecurity and Infrastructure Security Agency, highlighted the differences between this campaign and the sophisticated SolarWinds hacking attributed to Russian intelligence agents. The recent attack was relatively brief, superficial, and quickly detected.

Easterly emphasized that discussions with industry partners revealed that the intrusions were not leveraged to gain broader access, persist in targeted systems, or steal highly sensitive information. In summary, it was deemed to be primarily an opportunistic attack.

She further stated that although the campaign was a cause for concern and being treated with urgency, it did not pose a systemic risk to national security or the nation’s networks, unlike the SolarWinds incident.

A senior official from the Cybersecurity and Infrastructure Security Agency clarified that neither the U.S. military nor the intelligence community were affected. The Energy Department confirmed that two of its entities were compromised but provided no additional details.

The list of known victims includes various organizations such as Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia provincial government, British Airways, the British Broadcasting Company, and the U.K. drugstore chain Boots. The compromised program, MOVEit, is widely utilized for secure file sharing, potentially involving sensitive financial and insurance data.

Louisiana officials revealed that personal information of individuals with a driver’s license or vehicle registration in the state was likely exposed, encompassing details like names, addresses, Social Security numbers, and birthdates. They advised residents to freeze their credit to protect against identity theft.

The Oregon Department of Transportation confirmed that the attackers accessed personal information, including sensitive data, of around 3.5 million individuals who possessed state-issued identity cards or driver’s licenses.

The Cl0p ransomware syndicate responsible for the attack had announced on their dark web site that their victims, estimated to be in the hundreds, had until a specific deadline to initiate ransom negotiations. Failure to comply would result in the publication of stolen sensitive data.

As one of the most prolific cybercrime syndicates globally, Cl0p claimed that data stolen from governments, cities, and police departments would be deleted. However, cybersecurity experts caution against trusting their claims, citing previous cases where ransomware gangs published data even after receiving payment.

According to a senior official from the Cybersecurity and Infrastructure Security Agency, a small number of federal agencies were affected, but their names were not disclosed. The official emphasized that it was not a widespread campaign impacting numerous federal agencies. No federal agency had received extortion demands, and Cl0p had not leaked any data from affected federal agencies online.

The parent company of MOVEit’s U.S. maker, Progress Software, notified customers of the breach on May 31 and released a patch. However, cybersecurity researchers suspect that sensitive data might have been quietly exfiltrated by scores or possibly hundreds of companies before the patch was implemented.

The senior official from the Cybersecurity and Infrastructure Security Agency urged victims to come forward, although many are reluctant to do so. The lack of a federal data breach law and variations in disclosure requirements among states contribute to the hesitancy. However, publicly traded corporations, healthcare providers, and certain critical infrastructure entities have regulatory obligations.

According to SecurityScorecard, a cybersecurity firm, approximately 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies

Frequently Asked Questions (FAQs) about Ransomware

More about Ransomware

• Department of Energy and federal agencies compromised in cyber-extortion attack
• Russian ransomware gang behind the attack
• Details about the compromised file-transfer program MOVEit
• Concerns about data leaks by the Cl0p ransomware syndicate
• Impacted organizations and potential data breaches
• Cybersecurity insights and analysis