Russian hackers allegedly breach US government agencies in cyberattack

Multiple U.S. federal government agencies were hit in a global cyberattack allegedly carried out by the Russian ransomware gang known as Clop. The attack exploited a vulnerability in a file-sharing program popular among corporations and governments called MOVEit, per Homeland Security officials.

The US Cybersecurity and Infrastructure Security Agency is working to support the federal agencies that "experienced intrusions affecting their MOVEit applications," Eric Goldstein, the agency's executive assistant director for cybersecurity, told CNN on Thursday. "We are working urgently to understand impacts and ensure timely remediation."

While all the affected agencies have not been identified, a Department of Energy representative confirmed with CNN that the agency was among the targets. In addition to the U.S. government agencies, "several hundred" U.S. companies and organizations could have been swept up in the hacking spree, a senior CISA official estimated. In the past, Clop, the Russian ransomware gang allegedly behind the cyberattacks, has asked for multimillion-dollar ransoms. Still, the senior official added that the hackers made no demands in this case.

The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

The cyberattacks did not have any "significant impacts" on the federal agencies, CISA Director Jen Easterly said in a statement to the press, noting that the hackers were "largely opportunistic" in exploiting the software flaw to access networks.

Progress Software, the US creator of the MOVEit software, recently discovered another vulnerable point in the software. Over the past few weeks, the hackers have taken advantage of a previously identified flaw in the widely-used software to access the data they transferred. The firm behind the software told CNN they'd discovered a new vulnerability "that could be exploited by a bad actor."

"We have communicated with customers on the steps they need to take to further secure their environments, and we have also taken MOVEit Cloud offline as we urgently work to patch the issue," the company said in a statement.