US, UK accusations groundless: Russia

Trump delays new sanctions on Moscow

MOSCOW, April 17, (Agencies): The Kremlin on Tuesday dismissed as “groundless” warnings from Britain and the United States that Russian state-sponsored hackers were threatening their crucial computer networks.

“We don’t know what these new accusations are based on,” said President Vladimir Putin’s spokesman Dmitry Peskov.

“As before, neither our American nor our British colleagues have bothered to search for arguments, even weak ones,” he said during a regular briefing.

Peskov added that the claims were “groundless” and “unjustified”.

Washington and London said in a joint statement Monday that Russia’s hacking operation aimed “to support espionage, extract intellectual property, maintain persistent access to victim networks and potentially lay a foundation for future offensive operations”.

The US Department of Homeland Security said the hacking was part of a broad operation dubbed Grizzly Steppe, which DHS says comprises concerting cyber attacks by Moscow’s civilian and military intelligence agencies.

The announcement came in an unprecedented joint alert that underscored closer cooperation between Western governments fighting what they say is an ongoing, multi-faceted hacking and online disinformation campaign by Moscow.

A joint statement by the US Department of Homeland Security, the FBI and the UK’s National Cyber Security Centre said the main targets include “government and private-sector organizations,” as well as providers of “critical infrastructure” and internet service providers.

“Victims were identified through a coordinated series of actions between US and international partners,” according to a companion technical alert issued by the US Computer Emergency Response Team (US-CERT). Both nations have “high confidence” in the finding of Russian-sponsored cyber-meddling, which the alert said has been reported by multiple sources since 2015.

Australia also admonished Russia and accused Kremlin-backed hackers of cyberattacks on hundreds of Australian companies last year.

Respected US cybersecurity researcher Jake Williams said it was difficult for him to understand the motivation for Monday’s alert given that “the activity has been ongoing for some time.”

“Calling the Russians out on this hardly makes much sense unless there’s some other agenda (most likely political),” Williams, the president of Rendition Infosec, added via text message.

Routers direct data traffic across the internet. US-CERT said the compromised routers can be exploited for “man-in-the-middle” spoofing attacks, in which communications are intercepted by a seemingly trusted device that has actually been infiltrated by an attacker.

“The current state of US network devices — coupled with a Russian government campaign to exploit these devices — threatens the safety, security, and economic well-being of the United States,” the alert stated. An email message seeking comment from the Russian embassy in Washington, DC, received no response.

US-CERT urged affected companies, and public sector organizations and even people who use routers in home offices to take action to harden poorly-secured devices. But its alert cited only one specific product: Cisco’s Smart Install software.

Australian Defense Minister Marise Payne told reporters about 400 Australian companies were targeted in the Russian attacks, but there was no “exploitation of significance.” The country’s cyber security minister, Angus Taylor, said. “This attempt by Russia is a sharp reminder that Australian businesses and individuals are constantly targeted by malicious state and non-state actors.”

On March 15, US-CERT issued a similar alert saying the FBI and DHS had determined that Russian government “cyber actors” had sought to infiltrate US agencies as well as “organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.” It said Russian agents had obtained “remote access” to energy sector networks and obtained information on industrial control systems.

Experts have stressed that the March 15 bulletin did not mean Russia had obtained access to systems that control critical infrastructure such as the power grid. But Russia does have history in this regard, as many security experts blame it for several cybersabotage attacks on Ukraine’s power grid.

Also:

WASHINGTON: US President Donald Trump has delayed imposing additional sanctions on Russia and is unlikely to approve them unless Moscow carries out a new cyber attack or some other provocation, a senior administration official said on Monday.

US Ambassador to the United Nations Nikki Haley said on Sunday that Washington was preparing new sanctions on Russia over its support of Syrian President Bashar al-Assad.

“The ambassador got out ahead of things this time,” the senior administration official, who deals with the issue, told Reuters on condition of anonymity.

The Washington Post first reported that Trump had put a stop to a plan for additional economic sanctions on Russia.

The official said Trump was concerned that immediately imposing more sanctions, on the heels of last weekend’s US-led strike against Russian-backed Assad, would interfere with his efforts to negotiate agreements with Russian President Vladimir Putin on combating Islamic extremism, policing the internet and other issues.

The United States has taken a series of recent measures against Russia, including expelling diplomats over a poisoning case in Britain and imposing sanctions against 24 Russians, including Putin allies, over interference in the US presidential election and other “malign activity.” Moscow has denied any wrongdoing.

On Monday, the administration accused Russian governmentbacked hackers of a global cyber attack on routers and other networking equipment.

The official said Trump had expressed concern that if the administration did not proceed cautiously, tensions between Washington and Moscow — already at their worst since the Cold War — could escalate dangerously, the official said.