Russian hacking group compromised US energy corporations – 60 Minutes

The Biden administration warns of the potential for Russian cyberattacks on US soil, and in just lately unsealed indictments, the Justice Division launched particulars of cyberattacks it says the Russians launched up to now.

“The Russians pose a severe and chronic risk,” Deputy Lawyer Normal Lisa Monaco instructed correspondent Invoice Whitaker for a 60 Minutes report this week. “That is actually the kind of exercise we’re warning about in the present day concerning Russia’s response to the world’s response to the horror in Ukraine.”

Between 2012 and 2017, in line with the Justice Division, three Russian intelligence brokers and accomplices focused the vitality sector, hacking into a whole lot of corporations and organizations all over the world. Russian hackers additionally managed to interrupt into the pc community of a Kansas nuclear vitality firm, in line with the indictment.

Monaco mentioned whereas such incidents have occurred up to now, People ought to be ready for comparable assaults. “We see Russian state actors scanning, probing, searching for alternatives, searching for weaknesses in our techniques on vital infrastructure, on companies,” Monaco mentioned.

In the summertime of 2017, in line with a DOJ indictment, Russian hackers launched a cyberattack on the safety system of an abroad oil refinery, forcing all the plant to shut. Investigators recognized the plant because the Petro Rabigh Petrochemical and Refining Advanced in Saudi Arabia.

Robert Lee, a former NSA hacker and co-founder of cybersecurity agency Dragos, investigated the assault. He mentioned the hackers may have set off explosions and launched poisonous chemical compounds into the Saudi manufacturing unit with the malware they put in, generally known as “Triton”.

“That is the primary time in historical past that we have seen a cyberattack explicitly designed to kill individuals,” Lee mentioned. “It targets safety techniques. And people safety techniques are solely there to guard lives. So explicitly pursuing this method, the one motive to take action is to harm individuals.”

Lee says catastrophe was averted, solely as a result of the hackers made a small mistake of their software program. “As an alternative of inflicting the consequences they had been searching for, like an explosion the place you’d kill individuals, it simply shut down the plant,” he mentioned.

Lee additionally investigated two incidents in Ukraine broadly thought-about to be essentially the most damaging cyberattacks towards civilian infrastructure the world has ever seen.

In 2015, Lee says, Russian hackers from the army intelligence company, the GRU, broke into the networks of three completely different Ukrainian energy corporations and waited quietly earlier than launching their full-scale assault. “They broke in over the summer season, received into place, and so they began studying how you can function these techniques,” Lee mentioned. “And consequently, they disconnected greater than 60 substations throughout Ukraine and brought on energy outages for round 225,000 prospects within the useless of winter.”

A yr later, Lee says, the GRU hackers had been again with a way more refined assault – automated malware that might cripple a number of transmission stations with a single strike.

“It was a shock to everybody as a result of there was a number of idea about how you might do that,” Lee mentioned. “Individuals in my group on the cybersecurity aspect have been speaking about this for a very long time – it is attainable. However seeing it really demonstrated is massive proof that you are able to do it. And we additionally know now that they are daring sufficient to do it. .”

Lee mentioned the Russians may do the identical in america.

For the previous few years, Lee says his cybersecurity firm has tracked the identical GRU hacking group – recognized to researchers as “Sandworm” – putting in malware and probing energy corporations right here in america.