Biden says ‘no evidence’ Russia involved in US pipeline hack but Putin should act
Joe Biden said on Monday that “so far” there has been no evidence that the cyber attack late last week on a US pipeline had any involvement from the Russian state but that he believes Russia “has some responsibility” to deal with ransomware attacks emanating from its soil.
“It’s a criminal act, obviously. We have efforts under way with the FBI and DoJ to disrupt and prosecute ransomware criminals,” the US president said.
Questioned by the media, after an address at the White House in which Biden condemned attacks on critical infrastructure, about whether he believed Russia was involved in the hack, the US president said he was going to be meeting with Vladimir Putin in due course.
“So far there is no evidence based on, from our intelligence people, that Russia is involved, though there is evidence that the actors, ransomware, is in Russia. They have some responsibility to deal with this,” he said.
The development came as the FBI confirmed on Monday that the ransomware group responsible for the compromise of the pipeline network that supplies petrochemicals to the north-eastern US is DarkSide, an experienced collective of cybercriminals which has hacked scores of companies in the US and Europe.
A senior White House official said the FBI had been tracking DarkSide since at least last October.
Biden gave no details on a date or location for a meeting with the Russian president but the White House has previously indicated he would try to meet with Putin when he travels to Europe next month.
Speaking at a White House briefing earlier, Anne Neuberger, the deputy national security adviser for cyber, also declined to offer advice on whether the operator Colonial Pipeline should pay the hackers.“Typically that is a privatesector decision and the administration has not offered further advice at this time,” Neuberger said. “Given the rise in ransomware, that is one area we are definitely looking at now to say what should be the government’s approach.”
Neuberger said US intelligence was working to determine whether the hackers have ties to the Russian government or other nation states.
The confirmation of the identity of the hackers behind the attack followed a message on social media, apparently from the group, in which it said its goal was to make money rather than to advance geopolitical aims.
As relayed by DarkTracer, an inves
tigative platform, the message said in imperfect English: “We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives.
“Our goal is to make money, and do not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”
In a short statement the FBI said it “confirms that the DarkSide ransomware is responsible for the compromise of the Colonial Pipeline networks. We continue to work with the company and our government partners on the investigation.”
Cybersecurity experts who have tracked DarkSide said it appeared to be composed of veteran cybercriminals.
“They’re very new but they’re very organised,” Lior Div, the chief executive of a Boston-based security firm, Cybereason, told Reuters.
In response to the attack the Biden administration loosened regulations on the transport of petroleum products, as part of an effort to avoid disruptions in fuel supply. The commerce secretary, Gina Raimondo, said countering ransomware attacks was a top priority.
“Unfortunately, these sorts of attacks are becoming more frequent,” she told CBS. “We have to work in partnership with business to secure networks to defend ourselves.”
Energy experts said gasoline prices were unlikely to be affected if the pipeline was back to normal in the next few days. But continued disruption to the network which delivers about 45% of fuel consumed on the US east coast could cause increases.
A 5,500-mile network of pipelines operated by Colonial Pipeline, a Georgia-based company, carries more than 100m gallons of gasoline, diesel, jet fuel and home heating oil from the Gulf coast to New Jersey.
Colonial Pipeline said on Monday some lateral lines between terminals and delivery points were operating but its main lines were still shut down. It expected to “substantially” restore operational service by the end of the week.
“We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations,” the company said in a statement.
DarkSide is among ransomware gangs which have recently “professionalised”, Div told CNBC, adding that more than 10 of his customers had fought off break-in attempts in recent months.
Ransom hacks typically offer victims an encrypted key to make cryptocurrency payments. If the victim resists, hackers often threaten to leak confidential data.
DarkSide has hinted that it has made millions. Its site features stolen data from more than 80 companies in the US and Europe. Like many in the field, DarkSide appears to spare Russian, Kazakh and Ukrainian companies.
Typically, Div told Reuters, “they know who is the manager, they know who they’re speaking with, they know where the money is, they know who is the decision maker”.
Speaking to the Associated Press, Ed Amoroso, the chief executive of Tag Cyber, said state-backed hackers use the same intrusion methods as ransomware gangs.
Last week, Tulsa, Oklahoma, became the 32nd US state or local government to come under ransomware attack, said Brett Callow, a threat analyst with the cybersecurity company Emsisoft. Average ransom payouts last year tripled to more than $310,000.
David Kennedy at TrustedSec said once an attack is discovered, companies have little recourse but to rebuild infrastructure – or pay.
“Ransomware is absolutely out of control and one of the biggest threats we face as a nation,” he told the AP. “The problem we face is most companies are grossly underprepared to face these threats.”