Hunting the hunters: How Russian hackers targeted US cyber first responders in SolarWinds breach

[DonViejo]

By Zachary Cohen, Alex Marquardt and Geneva Sands, CNN

Updated 6:00 AM ET, Fri April 2, 2021

Washington (CNN)After infiltrating US government computer networks early last year as part of the SolarWinds data breach, Russian hackers then turned their attention to the very people whose job was to track them down.

Over the course of a few months, as US officials remained unaware of the breach, hackers identified a handful of key cyber security officials and analysts who would be among the first to respond once the hack was detected, so-called 'threat hunters,' and attempted to access their email accounts, according to two sources familiar with the matter.

While it is unclear if any of those accounts were compromised, sources say the fact that the hackers knew which working-level cybersecurity analysts at the Department of Homeland Security to go after suggests they were able to develop a much deeper understanding of US cyberdefenses than was previously known.

"It appears as if the Russian SolarWinds hackers possess granular information on personnel and who among them is likely to be involved in investigating the SolarWinds hack," said Cedric Leighton, a former NSA official and CNN military analyst. "This could mean that networks have been penetrated to a degree we've not known before. If that's true, we need a complete housecleaning of all our defensive cyberoperations."

more
https://www.cnn.com/2021/04/02/politics/russian-hackers-target-us-cyber-hunters-solarwinds/index.html