US treasury among those hacked by suspected state actor

By William Smith
The United States has been forced to issue an emergency order after it was revealed that a number of departments had been hacked...

The United States has been forced to issue an emergency order after it was revealed that a number of departments had been hacked.

In an emergency directive issued by the cybersecurity arms of the US department of Homeland Security, the US told all federal agencies to disconnect from SolarWinds’ Orion platform. The directive read: “Affected agencies shall immediately disconnect or power down SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1, from their network. [...] Affected entities should expect further communications from CISA and await guidance before rebuilding from trusted sources utilizing the latest version of the product available.”

Orion is software used by both companies and government organisations to manage networks and systems. Responding to the news, its maker Solarwinds said on Twitter: “SolarWinds asks all customers to upgrade immediately to Orion Platform version 2020.2.1 HF 1 to address a security vulnerability.”

The incident follows on from news last week that intelligence security firm FireEye had been hacked, resulting in “Red Team assessment tools”, which FireEye uses to test its clients’ defences, being stolen, and led to an 8% drop in its share price.

As part of its investigation, the company now says it has revealed “a global campaign” to infiltrate the software supply chain, via SolarWinds’ Orion network monitoring product. Hackers managed to insert “malicious code” into software updates for the product that then gave attacks remote access.

In a blog post, FireEye CEO Kevin Mandia said: “Based on our analysis, we have now identified multiple organizations where we see indications of compromise dating back to the Spring of 2020, and we are in the process of notifying those organizations. Our analysis indicates that these compromises are not self-propagating; each of the attacks require meticulous planning and manual interaction. Our ongoing investigation uncovered this campaign, and we are sharing this information consistent with our standard practice.”

Share

Featured Articles

Cloud & 5G - Day 1 highlights from the in-person stage

TECH LIVE LONDON returned to the Tobacco Dock last week. The stage host and Technology Magazine Editor in Chief, Alex Tuck, discusses the key themes

TECH LIVE LONDON: Day 2 highlights of the hybrid tech show

We take a look at some of the highlights of our final day at the Tech Live London show, including insights from Claroty, SalesForce and Oracle

TECH LIVE LONDON: An overview of the hybrid technology show

We take a look at the first day of Tech Live London with insights from technology leaders from companies such as IBM, Microsoft and Vodafone

TECH LIVE LONDON: Begins tomorrow at 10am!

Digital Transformation

Executive Q&A: Marc Lueck, CISO EMEA, Zscaler

Cloud & Cybersecurity

TECH LIVE LONDON: Registering, networking and logistics

Digital Transformation