US nuclear agency, three states, Microsoft attacked by Russian hackers

The hack of the nuclear agency was reported earlier by Politico. Microsoft spokesman said the company had found malicious code in its environment

The U.S. nuclear weapons agency and at least three states were hacked as part of a suspected Russian cyber-attack that struck a number of federal government agencies. Reuters reported that Microsoft Corp. was also breached, but the company denied its products were used to further attacks on others.

The Energy Department and its National Nuclear Security Administration, which maintains America’s nuclear stockpile, were targeted as part of the larger attack, according to a person familiar with the matter. An ongoing investigation has found the hack didn’t affect “mission-essential national security functions,” Shaylyn Hynes, a Department of Energy spokeswoman, said in a statement.

“At this point, the investigation has found that the malware has been isolated to business networks only,” Hynes said. The hack of the nuclear agency was reported earlier by Politico. Microsoft spokesman Frank Shaw said the company had found malicious code “in our environment, which we isolated and removed.”

“We have not found evidence of access to production services or customer data,” he said in a tweet. “Our investigations, which are ongoing, have found absolutely no indications that our systems were used to attack others.”

In addition, two people familiar with the broader government investigation into the attack said three state governments were breached, though they wouldn’t identify the states. A third person familiar with the probe confirmed that state governments were hacked but didn’t provide a number.

In an advisory Thursday that signaled the widening alarm over the the breach, the Cybersecurity and Infrastructure Security Agency said the hackers posed a “grave risk” to federal, state and local governments, as well as critical infrastructure and the private sector. The agency said the attackers demonstrated “sophistication and complex tradecraft.”

While President Donald Trump has yet to publicly address the hack, President-elect Joe Biden issued a statement Thursday on “what appears to be a massive cybersecurity breach affecting potentially thousands of victims, including U.S. companies and federal government entities.”

Biden’s Pledge

“I want to be clear: My administration will make cybersecurity a top priority at every level of government -- and we will make dealing with this breach a top priority from the moment we take office,” Biden said, pledging to impose “substantial costs on those responsible for such malicious attacks.”

Russia has denied any involvement in the attack.

Hynes, the Department of Energy spokeswoman, said that efforts were immediately taken to mitigate the risk from the hack, including disconnecting software “identified as being vulnerable to this attack.”

Although many details are still unclear, the hackers are believed to have gained access to networks by installing malicious code in a widely used software program from SolarWinds Corp., whose customers include government agencies and Fortune 500 companies, according to the company and cybersecurity experts. The departments of Homeland Security, Treasury, Commerce and State were breached, according to a person familiar with the matter.

“This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks,” the cybersecurity agency said in its bulletin.