News you may have missed #912: Analysis edition

Trojan Shield

SolarWinds: How Russian spies hacked US government departments. Last year, in perhaps the most audacious cyber attack in history, Russian military hackers sabotaged a tiny piece of computer code buried in a popular piece of software called SolarWinds. After it was installed, Russian agents went rummaging through the digital files of the US departments of Justice, State, Treasury, Energy, and Commerce —among others— and for nine months, they had unfettered access to top-level communications, court documents, even nuclear secrets. On July 4, the CBS television show 60 Minutes aired a special segment on this topic.

Why did the FBI’s encrypted phone sting not target US suspects? In 2018, a San Diego-led federal sting secretly launched an encrypted communications company as part of Operation TROJAN SHIELD (pictured). Over the next few years, FBI agents, working with law enforcement partners in Australia, New Zealand and Europe, seeded thousands of spyware-infected phones into the hands of criminals and used them to build cases against 300 organized crime groups around the world, from Australian biker gangs to Italian mafia cells. But one country was off limits for investigating agents: the United States. The San Diego Union-Tribune’s Kristina Davis explains why.

Opinion: Clearance holders need to protect America by studying espionage. John William Davis, retired counterintelligence officer who instructed the threat portion of the US Department of the Army’s Operations Security Course, argues that “many, many techniques for recruiting spies continue much as they did over preceding years. We can learn from the past and apply what we learn to the future.”

Massive hacker attack triggers US National Security Council emergency meeting

White HouseA large-scale cyberespionage attack targeting United States government computer systems, which some experts described as potentially being among “the most impactful espionage campaigns on record”, triggered an emergency meeting of the US National Security Council on Sunday, according to reports. Chaired by the US president, the National Security Council is the country’s most senior decision-making body.

Although it was only discovered last week, the cyberespionage campaign is believed to date to last spring, possibly as early as March. Sources called it a highly sophisticated operation that originated from a “top-tier” adversary –a term that refers to a handful of state actors that have access to the most elite cyber operatives and advanced technologies known to exist.

As of last night, US government officials had not publicly identified the state actor believed to be behind the cyberespionage campaign, which experts have coined the “2020 supply chain attack”. But several American and European news outlets pointed to Russia as the culprit, citing sources familiar with the investigation. The Washington Post said the Russian Foreign Intelligence Service, known as SVR, was behind the attack. The Russian government denied on Monday that its agencies had any role in the attacks.

The origins of the attack are believed to be in the private sector. It began when a sophisticated illicit cyber actor, known by the nickname Advanced Persistent Threat (APT) 29, or Cozy Bear, stole cyber tools used by two major government contractors, FireEye and SolarWinds. These cyber tools are used to detect and patch vulnerabilities in computer systems. These companies provide services to numerous US government customers, including the Departments of Defense, State, Treasury and Commerce. Other US government customers include the National Security Agency and the Office of the President, including the White House Situation Room. All of these entities have reportedly been affected by this cyber espionage operation.

By disguising their malicious software as software patches, the hackers were reportedly able to access and monitor, in real time, email traffic within and between government agencies. It is not known at this time whether US intelligence agencies, other than the National Security Agency, have been affected by this hack. All branches of the US military maintain intelligence components. Additionally, the Department of the Treasury operates the Office of Intelligence Analysis, while the Department of State is in charge of the Bureau of Intelligence and Research. The White House said yesterday that it had asked the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency to probe the attack and evaluate the extent of the damage caused to US government operations.

Author: Joseph Fitsanakis | Date: 15 December 2020 | Permalink