The supply chain attack used to breach federal agencies and at least one private company poses a “grave risk” to the United States, in part because the attackers likely used means other than just the SolarWinds backdoor to penetrate networks of interest, federal officials said on Thursday. One of those networks belongs to the National Nuclear Security Administration, which is responsible for the Los Alamos and Sandia labs, according to a report from Politico.

“This adversary has demonstrated an ability to exploit software supply chains and shown significant knowledge of Windows networks,” officials with the Cybersecurity Infrastructure and Security Agency wrote in an alert. “It is likely that the adversary has additional initial access vectors and tactics, techniques, and procedures (TTPs) that have not yet been discovered.” CISA, as the agency is abbreviated, is an arm of the Department of Homeland Security.

Elsewhere, officials wrote: “CISA has determined that this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations.”

Reuters, meanwhile, reported that the attackers breached a separate major technology supplier and used the compromise to get into high-value final targets. The news services cited two people briefed on the matter.

The attackers, whom CISA said began their operation no later than March, managed to remain undetected until last week when security firm FireEye reported that hackers backed by a nation-state had penetrated deep into its network. Early this week, FireEye said that the hackers were infecting targets using Orion, a widely used network management tool from SolarWinds. After taking control of the Orion update mechanism, the attackers were using it to install a backdoor that FireEye researchers are calling Sunburst.

Advertisement

Sunday was also when multiple news outlets, citing unnamed people, reported that the hackers had used the backdoor in Orion to breach networks belonging to the Departments of Commerce, Treasury, and possibly other agencies. The Department of Homeland Security and the National Institutes of Health were later added to the list.

Bleak assessment

Thursday’s CISA alert provided an unusually bleak assessment of the hack; the threat it poses to government agencies at the national, state, and local levels; and the skill, persistence, and time that will be required to expel the attackers from networks they had penetrated for months undetected.

“This APT actor has demonstrated patience, operational security, and complex tradecraft in these intrusions,” officials wrote in Thursday’s alert. “CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations.”

The officials went on to provide another bleak assessment: “CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated. CISA will update this Alert as new information becomes available.”

The advisory didn’t say what the additional vectors might be, but the officials went on to note the skill required to infect the SolarWinds software build platform, distribute backdoors to 18,000 customers, and then remain undetected in infected networks for months.

“This adversary has demonstrated an ability to exploit software supply chains and shown significant knowledge of Windows networks,” they wrote. “It is likely that the adversary has additional initial access vectors and tactics, techniques, and procedures that have not yet been discovered.”

Among the many federal agencies that used SolarWinds Orion, reportedly, was the Internal Revenue Service. On Thursday, Senate Finance Committee Ranking Member Ron Wyden (D-Ore.) and Senate Finance Committee Chairman Chuck Grassley (R-Iowa) sent a letter to IRS Commissioner Chuck Rettig asking that he provide a briefing on whether taxpayer data was compromised.

Advertisement

They wrote:

The IRS appears to have been a customer of SolarWinds as recently as 2017. Given the extreme sensitivity of personal taxpayer information entrusted to the IRS, and the harm both to Americans’ privacy and our national security that could result from the theft and exploitation of this data by our adversaries, it is imperative that we understand the extent to which the IRS may have been compromised. It is also critical that we understand what actions the IRS is taking to mitigate any potential damage, ensure that hackers do not still have access to internal IRS systems, and prevent future hacks of taxpayer data.

IRS representatives didn’t immediately return a phone call seeking comment for this post.

The CISA alert said the key takeaways from its investigation so far are:

• This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks
• The SolarWinds Orion supply chain compromise is not the only initial infection vector this APT actor leveraged
• Not all organizations that have the backdoor delivered through SolarWinds Orion have been targeted by the adversary with follow-on actions
• Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans

What has emerged so far is that this is an extraordinary hack whose full scope and effects won’t be known for weeks or even months. Additional shoes are likely to drop early and often.