Four key takeaways on the US government response to the pipeline ransomware attack

Senior cybersecurity officials testified before a key Senate committee on Tuesday after one of the nation’s largest pipeline operators was hit by an ongoing major ransomware attack that forced the company to shut down operations.

CNN has learned that federal agencies and private cybersecurity firms are investigating the attack on Colonial Pipeline but lawmakers made clear that the incident only adds to their broader concerns about hackers who are increasingly exploiting vulnerabilities in US infrastructure.

Here are some key takeaways from the hearing and CNN’s reporting on the government’s response to the Colonial Pipeline ransomware attack.

Cyberattacks becoming ‘more sophisticated, frequent and aggressive’

A top Biden administration cybersecurity official warned the Senate hearing that cyberattacks on the nation’s infrastructure are “growing more sophisticated, frequent and aggressive.”

“Malicious cyber actors today are dedicating time and resources towards researching, stealing, and exploiting vulnerabilities, using more complex attacks to avoid detection and developing new techniques to target information and communication technology supply chains,” acting Cybersecurity and Infrastructure Security Agency Director Brandon Wales told the Senate Homeland Committee, whose hearing was focused on a spate of recent incidents impacting the US.

His comments come as US officials are not only grappling with fallout from the Colonial Pipeline ransomware attack but a series of other recent cyberincidents that have raised questions about the security of these essential systems.

Ransomware locks out the rightful user of a computer or computer network and holds it hostage until the victim pays a fee. Ransomware gangs have also threatened to leak sensitive information in order to get victims to meet their demands.

“That threat of ransomware is certainly by no means new,” Department of Homeland Security Secretary Alejandro Mayorkas said at a press briefing at the White House later Tuesday. “As a matter of fact, last week I spoke … about the gravity of the threat. More than $350 million in losses are attributable to ransomware attacks this year. “

He said that was more than a 300% increase over the previous year.

“There’s no company too small to suffer a ransomware attack,” Mayorkas added. “We are seeing increasingly small- and medium-sized businesses suffer ransomware attacks.”

There are still questions about information sharing

Senior White House officials repeatedly said Monday their roles in addressing the latest ransomware incident were limited because Colonial Pipeline is a private company, even though it controls the gasoline supply to most of the eastern US.

Colonial has yet to share information with the federal government about the vulnerability that the ransomware group DarkSide took advantage of to infiltrate the fuel company, according to a top official with the CISA. This is because the investigation is ongoing; Colonial is working with the federal government and is expected to share information when it gets it.

“Our understanding is that that is part of the investigation that Colonial’s response vendor is still undertaking. That information has not yet been shared with the US government,” CISA Executive Assistant Director for Cybersecurity Eric Goldstein told CNN in a phone interview.

However, Goldstein said various agencies across the government are engaged with Colonial and as part of an interagency effort to understand the intrusion and identify information that can be shared broadly.

“Now, we are deeply focused on sharing information with other organizations to protect themselves, both from this specific actor, the Darkside ransomware group. And since we know that ransomware actors often use similar techniques and procedures, making sure that all organizations understand the steps that they could take to protect themselves,” he added.

CISA is not providing technical assistance to Colonial Pipeline as of now, according to Goldstein.

In the Senate hearing, Wales confirmed that DHS is still awaiting additional technical information from the Colonial Pipeline ransomware attack.

“I think right now we are waiting for additional technical information on exactly what happened at Colonial so we can use that information to potentially protect other potential victims down the road,” Wales said.

Wales said it’s “not surprising” that they haven’t yet received information since it’s early in the investigation, adding that CISA has historically had a “good relationship” with both Colonial and the cybersecurity firms that are working on their behalf.

Colonial Pipeline also did not contact CISA in the wake of the cyberattack, according to Wales.

“They did not contact CISA directly,” he said. “We were brought in by the FBI after they were notified about the incident.”

Wales said the agency received information “fairly quickly in concert with the FBI,” when pressed by Senate Homeland Security Ranking Member Rob Portman on whether it would have been helpful if Colonial reached out “immediately.”

Yet, Wales acknowledged that he did not believe Colonial would have connected them without the FBI involvement.

Colonial has engaged a third-party incident response company that is leading the investigation on their behalf, he said. CNN previously reported that FireEye Mandiant was brought on to manage the incident response investigation.

Biden administration officials frustrated with Colonial Pipeline

Biden administration officials have privately voiced frustration with what they see as Colonial Pipeline’s weak security protocols and a lack of preparation that could have allowed hackers to pull off the ransomware attack, officials familiar with the government’s initial investigation into the incident told CNN.

At the same time, US officials are working to track down the specific actors responsible for the breach, according to two people familiar with the federal response, a key part of the broader effort to bring the individual hackers to justice.

The internal tensions underscore a stark challenge facing the administration as it continues to grapple with the fallout from the brazen attack on the country’s critical infrastructure despite having limited access to the private company’s systems and technical information about the vulnerabilities exploited by the hackers.

Colonial declined to comment on the matter.

Still, US officials want to go on the offensive, and believe identifying the individual hackers who targeted Colonial Pipeline is one way of deterring future ransomware attacks.

Private sector companies worked with government to disrupt attack

Private sector companies also worked with US agencies to take a key server offline as recently as Saturday, disrupting ongoing cyberattacks against Colonial Pipeline Co. and other ransomware victims, according to two sources familiar with the matter.

The move to intervene, which allowed Colonial to recover some of its stolen data, was taken in response to the Darkside attack against the fuel pipeline company, one source told CNN, confirming the action first reported by Bloomberg.

Federal agencies and private companies that control the US-based servers were able to cut off key infrastructure used by the hackers to store stolen data before that information could be relayed back to Russia, both sources said.

Goldstein said CISA has no information about other victims at this time, but he pointed out that the Darkside ransomware group is a well-known threat actor that has compromised numerous victims in recent months.

Darkside is known to be based in Eastern Europe and carries out “double extortion” ransomware attacks, which is where they will both encrypt a victim’s data and then also steal some of the data and threaten to release it to cause reputational damage if the victim doesn’t pay, he said.

Therefore, even if a victim has strong backups for their data that allows them to restore the data that was encrypted, the bad actor still has another way to extort the victim, he said.

“There has been some discussion that perhaps this actor tries to refrain from attacking hospitals, schools and the like. But certainly, they’re seen as a pernicious ransomware group that has caused significant harm to its victims, both in the US and elsewhere,” Goldstein said.