Justice Department confirms SolarWinds hackers accessed Department emails

The Justice Department joins a growing list of formally confirmed victims in the espionage campaign.

The Justice Department on Wednesday joined a growing list of confirmed victims in the public and private sector of a suspected Russian espionage campaign that used tainted software made by SolarWinds.

The attackers were able to burrow their way into the Microsoft Office 365 email accounts of Justice Department employees and potentially had access to “around 3%” of such email accounts in the department, Marc Raimondi, a department spokesman, said in a statement. The Justice Department has more than 115,000 employees, according to a fiscal 2020 budget request, but not all employees use Office 365, Raimondi told CyberScoop. He declined to say how many employees do use the software.

The departments of Commerce, Energy and Treasury have also confirmed breaches. “Fewer than 10” U.S. agencies have been victimized by the targeted espionage operation, according to investigators.

The Justice Department statement comes a day after U.S. investigators for the first time formally implicated Russia in the hack, saying it was “likely Russian in origin.” Moscow has denied involvement in what is shaping up to be the first big cybersecurity test of Joe Biden’s presidency.

Justice Department officials did not learn of the malicious activity on their networks until Dec. 24, Raimondi said, more than 10 days after the Commerce Department became the first federal agency to confirm it had been breached. That underscores the ongoing nature of the investigation into the apparent espionage campaign, and the work left to be done to remediate it.

“After learning of the malicious activity, the [department’s Office of the Chief Information Officer] eliminated the identified method by which the actor was accessing the O365 email environment,” Raimondi said. There is no evidence that classified systems were affected, he said.

Raimondi said the breach constituted “a major incident” under the Federal Information Security Modernization Act, a designation that requires agencies to notify Congress.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure