The attackers of Colonial Pipeline identified by the FBI

May 11, 2021 06:23 GMT  ·  By

The operator of a major U.S. fuel pipeline (Colonial Pipeline), that was recently hit by a cyberattack, stated on Monday that it expects services to be mostly restored by the end of the week. FBI and administration officials managed to identify the perpetrators as a gang of criminal hackers. 

Colonial Pipeline, which transports about 45% of the fuel consumed on the East Coast, shut down operations last week after discovering a ransomware attack that had affected some of its systems.

On Monday, U.S. officials sought to allay concerns of price spikes or economic damage by highlighting that the fuel supply has not been disrupted so far. Moreover, the company was working to substantially restore operational service.

Nonetheless, the attack highlighted the vulnerability of the country's energy sector and other critical industries with privately owned infrastructure. Cybercriminals regularly carry out ransomware attacks, which encrypt data and paralyze victim networks before demanding substantial amounts of money to decrypt it.

The Colonial attack served as a powerful reminder of the threat's real-world implications. Even as the Biden administration works to combat organized hacking campaigns sponsored by foreign governments, cybercriminals continue to launch difficult-to-prevent attacks.

President Joe Biden stated on Monday, "We need to invest to safeguard our critical infrastructure." The attack, according to Energy Secretary Jennifer Granholm, highlights the utter vulnerability to cyberattacks on U.S. infrastructure.

The attack occurred as the administration continues to work on an executive order to strengthen cybersecurity defenses in the wake of massive breaches of federal agencies and private corporations by Russia.

Ransomware Task Force Established 

Meanwhile, the Justice Department established a ransomware task force to address situations like Colonial Pipeline.

Also, Energy Department announced the 100-day initiative on April 20 to protect energy infrastructure from cyber threats. Other critical industries, such as water and natural gas, will be subjected to similar measures.

Despite this, the governments and private sector's challenges remain enormous.

The FBI publicly assigned blame in this case on Monday, stating that the criminal syndicate behind the ransomware used in the attack is known as DarkSide.

According to Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, the group has been on the FBI's radar for months. She said the ransomware's business model is to demand ransom payments from victims and then split the proceeds with the developers, citing a "new and very troubling variant" as an example.

When asked if Russia was involved on Monday, Biden said, "I'm going to be meeting with President (Vladimir) Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there is evidence that the actors, ransomware, are in Russia."

He added that “They have some responsibility to deal with this,”