Once Stealthy, Russian Hackers Now Go Toe to Toe with U.S. Defenders

Editor's note: This article was updated April 3 to clarify when the NSA engaged in the defense of the unclassified network. Click here for more details.

In 2014, an adversary nation-state’s hackers cracked into one of the U.S. government’s unclassified national security systems and set about extracting information. That’s nothing out of the ordinary.

When the U.S. government network defenders discovered the hackers, however, instead of taking flight as they normally do, the attackers stuck around and fought back.

That was a first, National Security Agency Deputy Director Richard Ledgett said during an Aspen Institute discussion Tuesday.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

“It was basically hand-to-hand combat within a network,” Ledgett said. “We would take an action; they would then counter that. We’d remove their command and control channel to the malware. … They’d counter that by introducing a new command and control channel.”

NSA’s network defenders were aided in their fight by intelligence gleaned by the agency’s offensive hackers and other signal intelligence, Ledgett said, which reported on preparations the adversary nation hackers were making inside their own networks. The NSA team succeeded—eventually—in expelling the hackers from the U.S. government computer systems.

“It was about a 24-hour period of parry-riposte, parry-riposte, measure, countermeasure and so forth,” he said. “That was new. That’s a new level of interaction between a cyberattacker and a defender. … It was a little bit of a game changer.”

Ledgett did not name the adversary nation, but Russia is, by far, the likeliest possibility. He also did not name the breached system. 

The exchange highlights the increasingly hot cyber conflict between the U.S. and its Russian adversaries that began ramping up well before the release of reams of sensitive emails stolen from the Democratic National Committee and the Hillary Clinton campaign that bedeviled the 2016 election contest.

FireEye CEO Kevin Mandia traces a major shift to about August 2014 when his company responded to a breach of a U.S. government agency. Instead of retreating as they normally do when investigators pop onto the breached network, Mandia said, the Russian government-linked hackers stuck around.

“They knew we were observing them, but didn’t go away,” Mandia said during a recent breakfast with reporters before a FireEye conference. “That was different … something changed then.”

Russian hackers also began spending less time cleaning up traces of their operation around then, he said, leaving clues they formerly would have erased.

Mandia declined to name the hacked organization. The timing makes breaches of the State Department and White House unclassified email systems a possibility.

Mandia described the shift in tactics as the beginning of a series of changes that included increased targeting of anti-Putin academics and eventually the release of hundreds of emails damaging to the Clinton campaign. The shift may not have reached its conclusion, he said.  

“I sit here wondering, throughout my career, how many emails do I think the Russian government has stolen and how many of them have been posted online,” he said. “I would argue they’ve probably posted far less than 1 percent of 1 percent.”

That concern has been echoed since late 2016 by numerous lawmakers and members of the Obama administration who fear Putin will meddle in future U.S. elections if there are not additional consequences for his 2016 actions.

Also during Tuesday’s Aspen event, Ledgett firmly denied the suggestion by President Donald Trump and White House Press Secretary Sean Spicer that Britain’s spy agency GCHQ might have helped the Obama administration wiretap Trump Tower during the presidential campaign, calling it “categorically not realistic.”

Ledgett noted Trump and Spicer have both said they were quoting the speculation of a Fox News analyst rather than opining on their own behalf.

“They’d refuse to do it if asked, but they wouldn’t be asked,” he said, noting both nations' spy agencies are barred from helping the other break domestic laws.

Ledgett’s boss, NSA Director Adm. Michael Rogers, and FBI Director James Comey both testified Monday that there’s no evidence to support Trump’s claim that the Obama administration wiretapped Trump tower, a refutation supported by Republican and Democratic leaders of both congressional intelligence committees.