FBI, CISA, NSA & ODNI Cite Russia in Joint Statement on 'Serious' SolarWinds Attacks

The FBI, DHS's Cybersecurity & Infrastrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and National Security Agency (NSA) today issued a joint statement calling the recent SolarWinds breach and attacks on government networks mostly "an intelligence-gathering effort," and citing Russia the likely perpetrator of the attacks. 

The nod to Russia bolsters previous public statements by members of Congress, Secretary of State Mike Pompeo, and various security experts who have cited Russia as behind the attacks. Some experts believe it's the handiwork of Russia's SVR intelligence agency.

The so-called Cyber Unified Coordination Group (UCG) task force, made up of the FBI, CISA, and ODNI, with assistance of the NSA, has found less than 10 US government agencies were actually attacked via the breach of SolarWinds' Orion network management software.

"The UCG believes that, of the approximately 18,000 affected public and private sector customers of Solar Winds' Orion product, a much smaller number have been compromised by follow-on activity on their systems," the joint statement said. 

UCG said the APT group is "most likely Russian in origin" and behind "most or all" of the recently spotted attacks on government and private-sector networks. 

"This is a serious compromise that will require a sustained and dedicated effort to remediate," the agencies said.  

Last month CISA revealed that SolarWinds' Orion software wasn't the only initial attack vector: The attackers used other methods as well, which have not yet been publicly disclosed, according to the agency. Meanwhile, last week Microsoft revealed that the SolarWinds attackers had commandeered one of Microsoft's internal accounts to view — but not alter — some of its source code. 

Microsoft maintained that its threat-modeling approach mitigates any risk of the exposed code, but experts say questions remain as a full picture emerges of the impact.

Meantime, the NSA is supporting the UCG, Defense Department, Defense contractors, and national security systems with mitigations and assessments of the scope of the attacks, according to the UCG. UCG says it plans to publish indicators of compromise from the attacks as well as any additional information when they become available.