US: Hack of federal agencies ‘likely Russian in origin’

WASHINGTON (AP) — Top national security agencies in a rare joint statement Tuesday confirmed that Russia was likely responsible for a massive hack of U.S. government departments and corporations, rejecting President Donald Trump’s claim that China might be to blame.

The statement represented the U.S. government’s first formal attempt to assign responsibility for the breaches at multiple agencies and to assign a possible motive for the operation.

It said the hacks appeared to be intended for “intelligence-gathering,” suggesting the evidence so far pointed to a Russian spying effort rather than an attempt to damage or disrupt U.S. government operations.

“This is a serious compromise that will require a sustained and dedicated effort to remediate,” said the statement, distributed by a cyber working group comprised of the FBI and other investigative agencies.

The hacking campaign amounts to Washington’s worst cyberespionage failure to date. The intruders had been stalking through government agencies, defense contractors and telecommunications companies for at least seven months when it was discovered. Experts say that gave the foreign agents ample time to collect data that could be highly damaging to U.S. national security, though the scope of the breaches and exactly what information was sought is unknown.

The hacking campaign was extraordinary in its scale — 18,000 organizations were infected earlier this year by malicious code that piggybacked on popular network-management software from an Austin, Texas, company called SolarWinds. Of those 18,000 customers, the statement said, “a much smaller number have been compromised by follow-on activity on their systems,” with fewer than 10 federal government agencies falling into that category.

The Treasury and Commerce departments are among the agencies to have been affected. Sen. Ron Wyden, an Oregon Democrat, said after a briefing last month to the Senate Finance Committee that dozens of email accounts within the Treasury Department had been compromised and that hackers had broken into systems used by the department’s highest-ranking officials.

A senior executive of the cybersecurity firm that discovered the malware, FireEye, said last month that “dozens of incredibly high-value targets” have been infiltrated by elite, state-backed hackers. The executive, Charles Carmakal, would not name the targets. Nor has Microsoft, which says it identified more than 40 compromised government and private targets, most in the U.S.

U.S. officials, including then-Attorney General William Barr and Secretary of State Mike Pompeo, and cybersecurity experts have previously said Russia was to blame. But Mr. Trump, in a series of tweets late last month, sought to downplay the severity of the hack and raised the unsubstantiated idea that China could be responsible.

Tuesday’s statement makes clear that is not the case, saying the intrusions are likely “Russian in origin.”

Russia has denied involvement in the hack.
___
AP Technology Writer Frank Bajak in Boston contributed to this report.