A malware code associated with Russian hackers has reportedly been detected within the system of a Vermont electric utility.
The Russians did not actively use the code to disrupt operations of the utility, US officials told the Washington Post, but penetration of the nation’s electrical grid is significant because it represents a potentially serious vulnerability.
The code is associated with the hacking operation dubbed Grizzly Steppe by the Obama administration.
The utility involved, Burlington Electric, said the code was detected on a laptop associated with the company but not connected to the grid.
“We took immediate action to isolate the laptop and alerted federal officials of this finding,” the Burlington Electric Department said in a statement.
“Our team is working with federal officials to trace this malware and prevent any other attempts to infiltrate utility systems. We have briefed state officials and will support the investigation fully.”
The Department of Homeland Security alerted utilities on Thursday night about the malware code used in Grizzly Steppe, the company said.
“We acted quickly to scan all computers in our system for the malware signature. We detected the malware in a single Burlington Electric Department laptop not connected to our organization’s grid systems,” it said.
On Thursday, president Barack Obama expelled 35 Russian diplomats and imposed sanctions on two Russian intelligence agencies over their involvement in hacking US political groups in the 2016 presidential election.
Vladimir Putin said he would not retaliate by expelling US diplomats from Russia, a move praised by Donald Trump.
Government and utility industry officials regularly monitor the nation’s electrical grid because it is highly computerised and any disruptions can have disastrous implications for the functioning of medical and emergency services, the Post said.
US officials, including one senior administration official, said they are not yet sure what the intentions of the Russians might have been, the Post reported.
Federal officials have shared the malware code used in Grizzly Steppe with utility executives nationwide, a senior administration official said, and Vermont utility officials identified it within their operations, the Post reported.
The Department of Homeland Security did not immediately respond to a request for comment.
“This intrusion by itself was a minor incident that caused no damage,” a US intelligence official familiar with the incident and critical of Russian actions said on Friday night.
“However, we are taking it seriously because it has been tracked to familiar entities involved in a much broader and government-directed campaign in cyberspace and because the electric grid is a vulnerable and interconnected part of the nation’s critical infrastructure,” the official said.
The penetration may have been designed to disrupt the utility’s operations or as a test by the Russians to see whether they could penetrate a portion of the grid, the newspaper said.
Russia is widely considered responsible by US officials and private-sector security experts for a December 2015 hack of Ukraine’s power grid that knocked out the lights for about 250,000 people. That hack prompted National Security Agency chief Mike Rogers to say at a conference in March that it was a “matter of when, not if” a cyber adversary carried out a similar attack against the United States.
On Thursday Obama expelled 35 Russian diplomats in retaliation for US election hacking.