The compromise of multiple US federal networks following the SolarWinds breach was officially confirmed for the first time in a joint statement released earlier today by the FBI, DHS-CISA, and the Office of the Director of National Intelligence (ODNI).
"Over the course of the past several days, the FBI, CISA, and ODNI have become aware of a significant and ongoing cybersecurity campaign," the US intelligence agencies said [1, 2].
"This is a developing situation, and while we continue to work to understand the full extent of this campaign, we know this compromise has affected networks within the federal government."
The National Security Council (NSC) has established a Cyber Unified Coordination Group (UCG) following the SolarWinds breach to help the intelligence agencies better coordinate the US government's response efforts surrounding this ongoing espionage campaign.
To establish the UCG, the NSC used the Presidential Policy Directive-41 and its Annex, both issued in July 2016 by the Obama administration.
"The UCG process facilitates continuous and comprehensive coordination for whole-of-government efforts to identify, mitigate, remediate, and respond to this incident," NSC spokesman John Ullyot said two days ago.
"The highly-trained and experienced professionals across the government are working diligently on this matter."
(1/3) “Pursuant to Presidential Policy Directive-41 (26 July 2016) and its Annex, a Cyber Unified Coordination Group (UCG) has been established to ensure continued unity of effort across the United States Government in response to a significant cyber incident.
— NSC (@WHNSC) December 15, 2020
During this coordinated whole-of-government response effort, the FBI will be the lead for threat response, DHS-CISA will lead all asset response activities, and the ODNI will lead intelligence support and related activities.
The FBI will focus its efforts on collecting additional intelligence on the threat actors behind this compromise campaign and on attributing, pursuing, and disrupting their ongoing cyber-espionage efforts.
DHS-CISA has already issued an Emergency Directive after suspected Russian state-sponsored hackers breached SolarWinds asking federal civilian agencies to immediately disconnect or power down affected SolarWinds Orion products on their networks to block future attacks.
The DHS security agency is the one keeping in contact with all government, private sector, and international partners during the coordinated response efforts, as well as providing resources and information needed to those affected by this campaign to "recover quickly."
"CISA is engaging with our public and private stakeholders across the critical infrastructure community to ensure they understand their exposure and are taking steps to identify and mitigate any compromises," the joint statement reads.
The #FBI, @CISAgov, and @ODNIgov have released a joint statement regarding a significant #cybersecurity campaign. https://t.co/ZkaKpSpCb1
— FBI (@FBI) December 17, 2020
Yesterday, BleepingComputer also reported that Microsoft, FireEye, and GoDaddy collaborated to create a kill switch for the SolarWinds backdoor deployed on compromised networks to force the malware to terminate itself.
This backdoor is currently tracked as Solarigate by Microsoft and Sunburst by FireEye, and it was distributed via SolarWinds' auto-update mechanism onto the systems of roughly 18,000 customers.
The list of victims includes the US Treasury, the US Department of State, US NTIA, US NIH, DHS-CISA, and the US Department of Homeland Security.
SolarWinds' customer listing [1, 2] includes over 425 of the US Fortune 500, all top ten US telecom companies, the US Military, the US Pentagon, the State Department, NASA, NSA, Postal Service, NOAA, the US Department of Justice, and the Office of the President of the United States.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now