FBI warns of growing Russian hacker interest in US energy firms since Ukraine war

The FBI has warned about increased interest by Russian hackers in energy companies in the USA since the start of Russia’s war against Ukraine, though it did not indicate that a specific cyberattack was planned.

An FBI advisory obtained by AP stated that the Russian hackers have scanned at least five energy companies for vulnerabilities and at least 18 other companies in different sectors, including the defence industrial base and financial services. But the advisory didn’t mention the name of any targeted companies.

Scanning a network for flaws or vulnerabilities is common and does not indicate that an attack is forthcoming, though the activity can sometimes be a precursor of one. Still, the warning by the FBI, dated last Friday, underscored the Biden administration’s heightened cybersecurity concerns due to Russia’s war with Ukraine.

Also read: Zelensky to deliver ‘unprecedented’ virtual address to Japanese parliament

On Monday, the White House said that there was “evolving intelligence” indicating that Russia was considering launching cyberattacks against critical infrastructure in the US.

Anne Neuberger, the White House’s deputy national security adviser for cyber and emerging technologies, expressed frustration at a White House press briefing that some critical infrastructure entities have failed to fix known software flaws that could be exploited by Russian hackers.

Meanwhile, the Cybersecurity and Infrastructure Security Agency convened a call on Tuesday, with more than 13,000 industry stakeholders to warn about the potential for future cyberattacks and to reinforce the need to act to protect themselves.

The FBI advisory shared 140 internet protocol (IP) addresses that it said have been previously associated with the scanning of critical infrastructure in the country since at least March 2021. That scanning has increased since the start of the war last month, the alert stated, leading to a greater possibility of future intrusions.

Also read: As energy hub, Russia’s nuclear power goes well beyond oil, gas lines

The advisory said that though the FBI recognizes that scanning activity is common, the IP addresses are associated with “cyber actors who have previously conducted destructive cyber activity against foreign critical infrastructure”. The advisory said that in the instance, scanning activity likely indicated early stages of reconnaissance.

(With inputs from Agencies)