T
ThinkingSapien
Guest
Utilities Targeted in Cyberattacks Identified
Hackers homed in on smaller electricity providers in proximity to critical infrastructure; FBI investigating
More than a dozen U.S. utilities that were targets in a recent wave of cyberattacks have been identified by The Wall Street Journal. Some of the utilities, most of which are relatively small, are located near dams, locks and other critical infrastructure.These electricity providers were singled out in a hacking campaign that was brought to light in August by researchers at a Silicon Valley cybersecurity company. But little was known about the attacks until now.
The Federal Bureau of Investigation is probing the attacks and has contacted some, but not all, of the utilities, according to some of the utilities. It is possible that the hacking campaign is ongoing, according to security researchers.
Utilities said the FBI provided information that helped them scan their computer networks to see if firewalls—their first-line defenses—had been probed and whether malware-laced emails had been sent to their employees. The FBI declined to comment.
The targeted utilities, which operate in 18 states from Maine to Washington, include Cloverland Electric Cooperative in Michigan, which sits next to the Sault Ste. Marie Locks, a critical juncture for the transport of iron ore to U.S. steel mills; Klickitat Public Utility District in Washington state, which is near major federal dams and transmission lines that funnel hydroelectricity to California; and Basin Electric Power Cooperative in North Dakota, one of the few utilities that is capable of delivering electricity to both the nation’s eastern and western grids.
The hackers attempted to get malware installed on utility computers through “phishing” emails that trick recipients into opening them. The embedded malware, which in this case has been dubbed “Lookback,” could give attackers the ability to take control of victims’ computers and steal information.
The attackers left identifying information on targets briefly exposed on a server in Hong Kong, security researchers said, a portion of which the Journal was able to review. Of the 11 utilities named in this way by the Journal, none said that they had been breached but roughly half said that the FBI had warned them that they may have been targets. Some utilities said they didn’t detect any suspicious emails.