The US government is scrambling to address a breach that suspected Russian hackers carried out to spy on the US Departments of Treasury and Commerce departments.
The hackers broke in by tampering with the software updates from SolarWinds, a Texas-based IT company that serves numerous US government agencies including the Pentagon and the NSA, according to Reuters, which first reported the breach.
Security firm FireEye has also been investigating the incident, which it suspects may have begun in March, but remains ongoing. The hackers spearheaded the intrusions by packing malicious code inside a Windows installer from SolarWinds, which was then distributed to clients.
“The actors behind this campaign gained access to numerous public and private organizations around the world,” FireEye warned.
In response, the US’s Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency order on Sunday, calling on all government agencies to review their network for malicious activity and power down the affected SolarWinds IT product.
Specifically, the hack was carried out over the “2019.4 through 2020.2.1 HF1” version of the SolarWinds Orion product, which can help companies manage their IT products across a corporate or government network. The “SolarWinds.Orion.Core.BusinessLayer.dll” file contains a backdoor to communicate with the hacker’s servers. The file will remain dormant for up to two weeks before it'll begin retrieving and executing commands, which can include transferring files, executing programs, and disabling system services, including security safeguards.
SolarWinds—which has over 320,000 customers across the globe—has also confirmed the breach, calling it a “highly sophisticated, manual supply chain attack.”
“We have been advised this attack was likely conducted by an outside nation-state and intended to be a narrow, extremely targeted, and manually executed attack, as opposed to a broad, system-wide attack,” the company said in a statement. To plug the breach, SolarWinds has released an updated version of its Orion platform software, which it’s advising all customers to download and install.
"SolarWinds currently believes the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000," the company added in a SEC filing.
The US government is still investigating the breach, but officials fear the intrusions may have gone beyond Treasury and Commerce. According to The Washington Post, the US currently suspects the notorious Russian state-sponsored hacking group known as APT 29 or Cozy Bear is behind the attack. However, the Russian government is denying all involvement in the breach, calling the news another “unfounded attempt” from the US to blame the Kremlin for a hack.