U.S. intelligence and security agencies are investigating whether Russian government hackers were behind a cyber attack on the Ukrainian power grid last month, multiple sources familiar with the investigation told The Daily Beast.
Computer security experts at the Central Intelligence Agency, the National Security Agency, and the Homeland Security Department are examining samples of malicious software recovered from the networks of a power company in western Ukraine, which said on Dec. 23 that a large area of the country had been left without electricity due to “interference” in its systems. Approximately 700,000 homes were without power for several hours.
If the blackout is positively attributed to the work of hackers, it will be the first documented case of a cyber attack on an electrical power facility that led to a loss of electricity. While hackers are suspected of having caused a blackout at least once in the past, there has never been a publicly confirmed case with technical data to back it up.
ADVERTISEMENT
“It is a milestone,” John Hultquist, the director of cyber espionage analysis at computer security company iSIGHT Partners, which is analyzing hacking tools used in the intrusion, told The Daily Beast.
A confirmed cyber attack that caused a power outage would put pressure on President Obama to speak publicly about the event and say whether Russia was to blame. In 2014, Obama publicly identified North Korea as the culprit in a cyber attack on Sony Pictures Entertainment that destroyed company property and exposed private communications of executives. Obama ordered sanctions on North Korea, and U.S. government hackers attacked key portions of North Korea’s fragile Internet in response.
Spokespersons for the CIA and the Homeland Security Department declined to comment for this article. A spokesperson for the National Security Agency didn’t respond to a request for comment. The Ukrainian government has publicly blamed Russia for the attack.
The attack in Ukraine could be a bad omen for the U.S. power grid. Malicious software that was found on the networks of the company, Prykarpattyaoblenergo, was also used in a campaign targeting power facilities in the U.S. in 2014. It caused no damage but it set off alarms across the security and intelligence agencies.
At the time, the Homeland Security Department warned companies about the malware, known as BlackEnergy, which it said had been used in a hacking campaign that “comprised numerous industrial control systems environments…”
Industrial control systems are used to regulate the flow of electricity and to remotely control critical systems at power facilities. Security experts have warned for years that they could be commandeered via the Internet and give a hacker the ability to turn off electricity to whole cities.
“If you’re connected, you’re likely infected!” the department warned in another bulletin (PDF) to power companies in the spring of 2015, urging them to disconnect any control systems that were still connected to the Internet in light of the BlackEnergy threat.
Attacks that cause loss of electrical power on a large-scale are one of a handful of nightmare scenarios that U.S. national security officials have been trying to ensure don’t come to pass in America. They fear that cities could go without power for months or even weeks if equipment that generates or distributes electricity were taken offline and couldn’t be quickly replaced.
Among the questions the U.S. government analysts want to answer in the Ukrainian case is how exactly the hackers were able to penetrate the company’s systems and whether they were acting on behalf of the government in Moscow or with its implied consent.
There is no doubt, multiple experts said, that the BlackEnergy malware that has been linked to intrusions into power facilities in the U.S. was found in the Ukrainian company’s systems.
But U.S. and corporate analysts are proceeding cautiously given the momentousness of the event and the geopolitical implications of the Russian government’s involvement or complicity in a historic act of aggression. They’re also aware of the fact that most power outages in the U.S. ultimately attributed to natural causes, such as storms and overgrown tree limbs, and that for all the hand-wringing about cyber attacks on the grid there has never been a proven instance. An outage in Brazil that was attributed to hackers was later said to be caused by dirty equipment.
Experts in government and at at least three security companies are still compiling technical data that would show conclusively that the blackout was the result of a malicious cyber attack and not some other factor, such as human error or a mechanical failure.
But something close to a consensus view that the power outage was deliberately caused was forming among independent analysts on Tuesday. iSIGHT as well security company ESET have linked the blackout to hackers. And the SANS Institute, a respected research group that trains U.S. government security experts, while not conclusively identifying the cause of the blackout said in a blog post last week, “The Ukrainian power outage is more likely to have been caused by a cyber attack than previously thought.”
Hultquist, of iSIGHT, said the hackers were likely part of a group that the company dubbed Sandworm and that it tracked in 2014, during the probes of U.S. power facilities that prompted the government warning.
“I believe at the time they were preparing for an escalating event with U.S. and Europe,” Hultquist said. It’s still not clear why the hackers didn’t follow through and cause a power outage, but Hultquist described their probes as a “reconnaissance” mission that would give them the lay of the land should they have chosen to launch an assault.
Russian hackers have been blamed for cyber attacks in the past, including against Pentagon networks last year in an apparent attempt to steal military secrets.
Given that Russia has demonstrated both the will and the expertise to use cyber attacks, U.S. officials are paying especially close attention to the event in Ukraine.
“I’m confident they and the Ukrainian government have a lot of data and a lot of technical evidence that’s not yet public,” Robert M. Lee, the founder and CEO of Dragos Security, who has worked in the intelligence community and the military as a cyber warfare operations officer, told The Daily Beast.
White House officials declined to comment for this article. But Obama has stressed for years that U.S. electrical systems are vulnerable to cyber attacks. In May 2009, in his first major address about cyber security after taking office, Obama said, “We know that cyber intruders have probed our electrical grid and that in other countries cyber attacks have plunged entire cities into darkness.”
He did not name those countries.
In 2008, Tom Donohue, then the CIA’s chief cyber-security officer, said that hackers had breached computer systems of utility companies outside the U.S. and had demanded ransom or else they’d shut down the power.
Donohue, who spoke at a gathering in New Orleans of security executives from government agencies and large U.S. utilities and energy companies, said that in at least one case an intrusion had caused a power outage that affected multiple cities. The CIA didn’t know who was behind the attacks, “but all involved intrusions through the Internet,” Donohue said.
