Hack at Treasury and Commerce spurs emergency order from CISA

Treasury Dept. headquarters in Washington, D.C. (Photo credit: Bill Perry/Shutterstock.com)

This article was updated on Dec. 14 to reflect the reported Department of Homeland Security breach.

The Cybersecurity and Infrastructure Security Agency late Sunday night issued an emergency directive in response to a sophisticated cyberattack mandating all federal civilian agencies stop using SolarWinds' Orion products "immediately."

"The compromise of SolarWinds' Orion Network Management Products poses unacceptable risks to the security of federal networks," said CISA acting Director Brandon Wales. The "directive is intended to mitigate potential compromises within federal civilian networks, and we urge all our partners — in the public and private sectors — to assess their exposure to this compromise and to secure their networks against any exploitation."

CISA also said that federal agencies using SolarWinds products should provide a completion report to the CISA by noon Monday.

SolarWinds, which provides IT management and monitoring products, boasts a long list of government customers including the Defense Department, NASA and NSA as well as "425 of the U.S. Fortune 500" companies," according to company's website,

The order is just the fifth binding operational directive issued by CISA in its history.

Hackers – likely backed by Russia, according to analysts and government sources – breached both the Commerce and Treasury Departments' networks, Reuters first reported Sunday afternoon. The news hit several days after FireEye announced its own network was compromised and cyber exploits used to test client networks were stolen.

"Our analysis indicates that these compromises are not self-propagating," FireEye CEO Kevin Mandia wrote in a Dec. 13 blog post. "Each of the attacks require meticulous planning and manual interaction."

On Monday, Reuters reported that the Department of Homeland Security had also been breached.  DHS officials would not confirm the department had been hit by the same hackers that targeted Commerce and Treasury, but released a statement that DHS "is aware of cyber breaches across the federal government and working closely with our partners in the public and private sector on the federal response."

SolarWinds said the hackers likely exploited a vulnerability in a patch released earlier this year.

"We are aware of a potential vulnerability which if present is currently believed to be related to updates which were released between March and June 2020 to our Orion monitoring products," Kevin Thompson, the company's president, said in a statement.

"We are acting in close coordination with FireEye, the Federal Bureau of Investigation, the intelligence community, and other law enforcement to investigate these matters. As such, we are limited as to what we can share at this time," he continued.

An FBI spokesman said the agency is aware of the breach but declined to comment further.

In a Dec. 14 filing to the Securities and Exchange Commission, SolarWinds stated that it believes that fewer than 18,000 customers use products containing the vulnerability. The company said it provided 33,000 Orion customers with instructions on how to mitigate potential damage. SolarWinds is preparing a second hotfix scheduled to be released on or before Dec. 15, according to the SEC filing.

In a Sunday night post, FireEye said it is tracking the actors behind the "global intrusion campaign" using malware the company named SUNBURST. The company said the campaign, which it named UNC2452, has gained access to "numerous" public and private organizations around the world.

"This campaign may have begun as early as Spring 2020 and is currently ongoing," according to the FireEye post. "The campaign is the work of a highly skilled actor and the operation was conducted with significant operational security."

FireEye said SUNBURST uses a backdoor that initially remains dormant for up to weeks after being delivered. The malware gives the attacker ranging authority over compromised systems, including the ability to transfer riles, run programs and disabling services. The malware allows the attacker to "blend in with legitimate SolarWinds activity," according to FireEye's post.

Former CISA director Chris Krebs tweeted Sunday night that anyone who uses Orion should assume they're compromised.

"Immediately activate your incident response team. Odds are you're not affected, as this may be a resource intensive hack. Focus on your Crown Jewels. You can manage this," he said.

Sen. Ron Wyden (D-Ore.) in a Dec. 14 statement called the breach a "massive national security failure" with potential consequences for "years to come." The lawmaker said he was trying to shake loose more information from the government about the scope of the breach. "I fear that the damage is far more significant than currently know," he said.