Energy Department finds SolarWinds-related malware on IT networks, says critical systems unaffected

DOE joins a growing list of federal agencies that have been been affected by the hacking campaign

The Department of Energy on Thursday said it had found malicious software related to the breach of contractor SolarWinds on the department’s IT networks, making it the latest federal agency to be swept up in a hacking campaign reportedly tied to Russia.

“At this point, the investigation has found that the malware has been isolated to business networks only, and has not impacted the mission essential national security functions of the Department, including the National Nuclear Security Administration,” Department of Energy spokeswoman Shaylyn Hynes said in a statement.

DOE joins a growing list of federal agencies, including the departments of Homeland Security and Treasury, that have been reportedly breached in the hacking campaign. The cyber activity, which The Washington Post reported is connected to a Russian intelligence service, has involved using tampered software from Austin-based SolarWinds, to gain persistence access to victim networks. SolarWinds’ software is also widely used in critical industries such as electricity, oil and gas, and manufacturing.

“When DOE identified vulnerable software, immediate action was taken to mitigate the risk, and all software identified as being vulnerable to this attack was disconnected from the DOE network,” Hynes added.

The Department of Homeland Security on Thursday said that the attackers are using other means, and not just the SolarWinds backdoor, to access victim networks. “[R]emoving this threat actor from compromised environments will be highly complex and challenging for organizations,” DHS’s Cybersecurity and Infrastructure Security Agency said in a public advisory.

The Russian government has denied involvement in the hacking campaign.

President-elect Joe Biden on Thursday said he had instructed his aides to learn everything they could about the hacking campaign, which could be one of the first big cybersecurity tests of his presidency.

The battle against the hackers is ongoing. Cybersecurity firm FireEye said on Wednesday that it had found a “killswitch” — or seized internet domain — that could be used to hamper the attackers’ ability to distribute the malware.

Politico reported earlier Thursday that the hacking campaign affected Department of Energy computer networks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure