Hack of federal agencies probably ‘Russian in origin,’ U.S. says

WASHINGTON —  Top national security agencies confirmed that Russia was probably responsible for a massive hack of U.S. government departments and corporations, rejecting President Trump’s claim that China might be to blame.

The rare joint statement represented the U.S. government’s first formal attempt to assign responsibility for the breaches at multiple agencies and to assign a possible motive for the operation. It said the hacks appeared to be part of an “intelligence-gathering” effort, suggesting the evidence so far pointed to a Russian spying effort rather than an attempt to damage or disrupt U.S. government operations.

The agencies made clear the operation was “ongoing” and indicated the hunt for new threats was not over.

“This is a serious compromise that will require a sustained and dedicated effort to remediate,” said the statement, distributed by the FBI, the National Security Agency, the Office of the Director of National Intelligence, and the Cybersecurity and Infrastructure Security Agency.

It was not clear why the statement was issued now, though it puts the imprimatur of national security agencies on information that members of Congress, who were briefed on it earlier, were clamoring for the White House to make public.

The Associated Press reported last month that officials at the White House had been prepared to reveal that Russia was the “main actor” in the hack but were told at the last minute to stand down. The day of that report, Dec. 19, Trump tweeted that the “Cyber Hack is far greater in the Fake News Media than in actuality” and suggested without any evidence that China could be to blame.

Sen. Mark R. Warner, the Democratic vice chairman of the Senate Intelligence Committee, lamented the belated statement, saying that “it’s unfortunate that it has taken over three weeks after the revelation of an intrusion this significant for this Administration to finally issue a tentative attribution.” He said he hoped for a more definitive assignment of blame as well as a warning to Russia, which has denied involvement in the hack.

With the public finger-pointing taking place in the final two weeks of the Trump administration, it will almost certainly fall to incoming President Joe Biden to decide how to respond. Biden has said his administration will impose “substantial costs” on countries responsible for U.S. government hacks, but it is unclear whether the response in this case will involve sanctions, prosecution, offensive cyber operations or some combination of those options.

The hacking campaign amounts to Washington’s worst cyberespionage failure to date. The intruders had been stalking through government agencies, defense contractors and telecommunications companies for at least seven months when it was discovered. Experts say that gave the foreign agents ample time to collect data that could be highly damaging to U.S. national security, though the scope of the breaches and exactly what information was sought are unknown.

U.S. officials, including then-Atty. Gen. William Barr and Secretary of State Michael R. Pompeo, and cybersecurity experts have previously said Russia was to blame. But Trump, in a series of tweets late last month, sought to downplay the severity of the hack and raised the unsubstantiated idea that China could be responsible.

An estimated 18,000 organizations were infected earlier by malicious code that piggybacked on popular network-management software from an Austin, Texas, company called SolarWinds. Of those customers, though, “a much smaller number have been compromised by follow-on activity on their systems,” the statement said, noting that fewer than 10 federal government agencies have so far been identified as falling into that category.

The Treasury and Commerce departments are among the agencies known to have been affected. Sen. Ron Wyden, an Oregon Democrat, said after a briefing last month provided to the Senate Finance Committee that dozens of Treasury Department email accounts had been compromised and that hackers had broken into systems used by the department’s highest-ranking officials.

A senior executive of the cybersecurity firm that discovered the malware, FireEye, said last month that “dozens of incredibly high-value targets” have been infiltrated by elite, state-backed hackers. The executive, Charles Carmakal, would not name the targets. Nor has Microsoft, which said it identified more than 40 compromised government and private targets, most in the U.S.

Microsoft said in a blog post last week that hackers tied to the intrusions of government agencies and companies sneaked further into its systems than previously thought and were able to view some of the code underlying the company’s software, but weren’t able to make any changes to it.

The extent of affected targets remains unknown.

“I think it’s highly unlikely at this stage of the investigation they can actually be certain that there are only 10 agencies impacted,” said Dmitri Alperovitch, former chief technical officer of the cybersecurity firm CrowdStrike.

Ben Buchanan, a Georgetown University cyberespionage expert, said the fact that all these investigating agencies are now attributing the hacking campaign to Russia “removes any remaining serious doubts about the perpetrators.”

As for the number of federal agencies compromised, he said it’s difficult to know “from the outside how they’ve evaluated this.” While such assessments are difficult, Buchanan said, he believes the government must have some evidence for the claim given the joint nature of the statement.

Tuesday’s statement makes clear that is not the case, saying the U.S. investigation reveals that a cyber actor, “likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks.”

“At this time, we believe this was, and continues to be, an intelligence gathering effort. We are taking all necessary steps to understand the full scope of this campaign and respond accordingly,” the statement said.