US: Hack on Government Agencies Goes Beyond SolarWinds Users
The alert from the Cybersecurity and Infrastructure Security Agency (CISA) also warns that removing the hackers from compromised systems won’t be easy.
UPDATE: Microsoft was also hacked, according to Reuters, citing unnamed sources. The company’s own software tools were then used to attack other victims. However, Microsoft President Brad Smith is denying the report.
Original story:
The massive hack against the US government may be much worse than previously thought.
On Thursday, Politico reported the hackers broke into the US Energy Department and National Nuclear Security Administration, which maintains the country’s nuclear weapons stockpile. However, it remains unclear what the culprits might have accessed.
The massive hack against the US government may be much worse than previously thought.
On Thursday, Politico reported the hackers broke into the US Energy Department and National Nuclear Security Administration, which maintains the country’s nuclear weapons stockpile. However, it remains unclear what the culprits might have accessed.
On the same day, the cybersecurity division under the Department of Homeland Security warned the massive breach was pulled off using a variety of tactics. “CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated,” the Cybersecurity and Infrastructure Security Agency said in the alert.
The additional “access vectors” refers to a report from the cybersecurity firm Volexity, which revealed evidence the same culprits hacked a think tank by exploiting a vulnerability in its Microsoft Exchange Control Panel. The attackers then bypassed the multi-factor authentication system to access a victim’s email inbox.
As a result, it’s possible the culprits behind the breach may have hit more victims through other vulnerable software. The other bad news deals with recovering from the attack. “CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations,” the agency added.
Source: By Michael Kan December 17, 2020
https://www.pcmag.com/news/us-hack-on-government-agencies-goes-beyond-solarwinds-users
