facebook linkedin twitter

Biden Says Colonial Pipeline Attack Tied to Russian Ransomware Hackers

May 11, 2021 by Tom Ramstack
In this Sept. 8, 2008 photo traffic on I-95 passes oil storage tanks owned by the Colonial Pipeline Company in Linden, N.J.(AP Photo/Mark Lennihan)

WASHINGTON — The ongoing energy crisis created by a Russian gang’s ransomware attack late last week led the Biden administration to announce a multi-pronged strategy for confronting it on Monday.

While President Biden declared an emergency, Colonial Pipeline officials said they expect to resume transporting most of the company’s roughly 100 million gallons of gasoline and other fuel daily by the end of this week.

The company’s pipeline serves customers along a route that runs from Houston to New York, representing about 45% of the refined fuel sold on the East Coast.

A group the FBI identified Monday as “Darkside” not only shut down Colonial Pipeline but also stole 100 gigabytes of data from the company’s servers. The members threatened to release the information on the internet if it is not paid a ransom of an undisclosed amount.

Biden added, “There is evidence that the actor’s ransomware is in Russian. They have some responsibility to deal with this.”

The gang posted a message on the dark web saying they wanted “only to make money” but denied any government affiliation.

Ransomware refers to an attack by computer hackers who lock out the rightful users and say they will not unlock the network until the victims pay a fee.

Biden announced a “whole of government” emergency response Sunday. The Energy Department is taking the lead, first by calling utilities to discuss strategies for stopping the attacks and also assessing the damage with state officials.

Other agencies joining the response after White House meetings during the weekend are the departments of Defense, Homeland Security, Transportation, Treasury and Justice.

The Justice Department is using its cybersecurity task force that started operating last month. Biden said he is putting together an executive order to deal with the emergency.

On Sunday, the Transportation Department announced it would relax restrictions on transporting fuel by trucks during the pipeline interruption. The temporary rules expand the “hours of service” trucks and their drivers can operate on highways in the affected states.

“[The Transportation Department’s] top priority is safety, and while current circumstances dictate providing industry flexibility, [the Federal Motor Carrier Safety Administration] will work closely with its state and industry partners to monitor driver work hours and conditions for the duration of the exemption,” a Transportation Department statement says.

The ransomware targeted at Colonial Pipeline is heightening concerns about the vulnerability of U.S. computer-controlled infrastructure after several high-profile attacks. They included the 2020 SolarWinds hack, also traced to the Russians.

SolarWinds compromised sensitive data from many government agencies, including the Defense Department, the Treasury Department, the State Department and the Homeland Security Department.

The Justice Department announced last month that 2020 was the worst year yet for ransomware attacks. Some of the demands for money reached into the millions of dollars.

Biden said at a White House press conference Monday that the attacks reaffirm the need for the improved infrastructure he plans as a centerpiece of his $2.3 trillion economic development plan. One component of his plan that started last month is a public-private cybersecurity initiative.

“It began with a 100-day sprint to improve cybersecurity in the electric sector, and we will follow that with similar initiatives for national gas pipelines, water and other sectors. In addition to companies stepping up, we need to invest to safeguard our critical infrastructure,” Biden said.

However, he acknowledged that the government must depend on private companies for much of the security. They own about 85% of the nation’s infrastructure, according to government estimates.

Elizabeth Sherwood-Randall, the White House domestic security adviser, said during the Monday press briefing, “When those companies are attacked, they serve as the first line of defense and we depend on the effectiveness of their defenses.”

Alpharetta, Ga.-based Colonial Pipeline claims its 5,500-mile network is the largest U.S. pipeline carrier of refined fuels.

Cybercrime

September 1, 2021
by Tom Ramstack
Executives Advocate for Legislation to Unite Government and Private Cybersecurity

WASHINGTON -- A cybersecurity expert told a congressional panel Wednesday that private industry alone cannot be expected to effectively confront... Read More

WASHINGTON -- A cybersecurity expert told a congressional panel Wednesday that private industry alone cannot be expected to effectively confront the kinds of cyberattacks that have wreaked havoc on U.S. computer networks in recent years. He testified to a House Homeland Security subcommittee as it considers... Read More

August 27, 2021
by Reece Nations
FBI Warns of New Hive Ransomware Threat

WASHINGTON — The Federal Bureau of Investigation distributed a Flash report on Friday warning of indicators of compromise from the... Read More

WASHINGTON — The Federal Bureau of Investigation distributed a Flash report on Friday warning of indicators of compromise from the Hive ransomware known to have infiltrated business networks. The ransomware utilizes multiple mechanisms as attachments to gain access and “Remote Desktop Protocol” to operate once embedded,... Read More

Report: Census Hit by Cyberattack, US Count Unaffected

U.S. Census Bureau computer servers were exploited last year during a cybersecurity attack, but it didn't involve the 2020 census,... Read More

U.S. Census Bureau computer servers were exploited last year during a cybersecurity attack, but it didn't involve the 2020 census, and hackers' attempts to keep access to the system were unsuccessful, according to a watchdog report released Wednesday. The attack took place in January 2020 on... Read More

July 29, 2021
by Tom Ramstack
Government Tries to Play Catch-Up Against Fast-Moving Cyberattacks

WASHINGTON -- Congress took a stab Thursday at improving the nation’s cybersecurity as the federal government mobilizes more resources against... Read More

WASHINGTON -- Congress took a stab Thursday at improving the nation’s cybersecurity as the federal government mobilizes more resources against ransomware and hackers. Both President Joe Biden and members of a House Homeland Security subcommittee described threats to U.S. computer systems as a potentially devastating economic... Read More

July 26, 2021
by Reece Nations
Pegasus Spyware Used to Target Activists, Journalists, Report Finds

An investigation by the Paris-based journalism nonprofit Forbidden Stories and the human rights group Amnesty International revealed thousands of people... Read More

An investigation by the Paris-based journalism nonprofit Forbidden Stories and the human rights group Amnesty International revealed thousands of people were targeted by spyware developed by the Israel-based NSO Group Technologies. Hundreds of human rights activists, government officials, business executives and journalists worldwide had their cellphones... Read More

July 20, 2021
by Tom Ramstack
Government Takes Helm on Cybersecurity As Ransomware and Spying Threats Grow

WASHINGTON -- As the international blame game over ransomware heats up this week, the U.S. government is scrambling for solutions... Read More

WASHINGTON -- As the international blame game over ransomware heats up this week, the U.S. government is scrambling for solutions with increasingly combative strategies. Legislation that won tentative approval in Congress on Monday anticipates a bigger role for the U.S. government in overseeing cybersecurity of critical... Read More

News From The Well
scroll top