Cybersecurity firm: Booting hackers is a complex chore

BOSTON — Efforts to assess the impact of a more than seven- month- old cyberespionage campaign blamed on Russia—and boot the intruder s—remain in their early stages, says the cybersecurity firm that discovered the attack.

The hack has badly shaken the U.S. government and private sector. The firm, FireEye, released a tool and a white paper Tuesday to help potential victims scour their cloud-based installations of Microsoft 365 — where users' emails, documents and collaborative tools reside — to determine if hackers broke in and remain active.

The aim is not just to ferret out and evict the hackers but to keep them from being able to re-enter, said Matthew McWhirt, the effort's team leader.

“There' s a lot of specific things you have to do — we learned from our investigations — to really eradicate the attacker,” he said.

Since FireEye disclosed its discovery in mid-December, infections have been found at federal agencies including the departments of Commerce, Treasury, Justice and federal courts. Also compromised, said Fire Eye chief tech nical officer Charles Carmakal, are dozens of private sector targets with a high concentration in the software industry and Washington D.C. policyoriented think tanks.

The intruders have stealthily scooped up intelligence for months, carefully c ho osing targets from the roughly 18,000 customers infected with malicious code they activated after sneaking it into an update of network management software first pushed out last March by Texas-based SolarWinds.

“We continue to learn about new victims almost every day. I still think that we're still in the early days of really understanding the scope of the threat- actor activity,” said Carmakal.

During a Senate con firmation hearing on Tuesday, national intelligence director nominee Avril Ha in es said she's not yet been fully briefed on the campaign but noted that the Department of Homeland Security has deemed it“a grave risk” to government systems, critical infrastructure and the private sector and “it does seem to be extraordinary in its nature and its scope.”

The public has not heard much about who exactly was compromised because many victims still can't figure out what the attackers have done and thus “may not feel they have an obligation to report on it,” said Carmakal.

“This threat actor is so good, so sophisticated, so disciplined, so patient and so elusive that it's just hard for organizations to really understand what the scope and impact of the intrusions are. But I can assure you there area lot of victims beyond what has been made public to date,” Carmakal said.