Hacker Group Attacking US Pipeline Company Suspected of Possible Links to Russia

[Asia Economy Reporter Park Byung-hee] CNN and Bloomberg reported on the 9th (local time) that claims are continuously being made that the hacker group that attacked Colonial Pipeline, the largest pipeline operator in the United States, may be linked to Russia.

CNN cited a former senior security official, reporting that the hacker group 'DarkSide,' which halted pipeline operations, originated from a Russian criminal organization. The official added that DarkSide targets countries that do not use the Russian language. CNN did not disclose the name of this official.

Bloomberg, citing security industry sources, reported that although it is still in the early stages of investigation, evidence is being confirmed that DarkSide is connected to Russia or Eastern European countries.

Dmitri Alperovich, former Chief Technology Officer (CTO) at cybersecurity firm CrowdStrike Holdings, said that the hackers who attacked Colonial are known among security experts as a Russian-speaking group that suddenly appeared last summer. Alperovich added that, like many other Russian cybercrime groups, they use destructive computer software to target non-Russian companies.

Rob Lee, CEO of another security firm Dragos, stated that there have been several hacking incidents related to DarkSide ransomware in recent months, including attacks on power companies, and Dragos has been responding to these. Lee noted that the companies previously attacked were smaller than Colonial, generally worth hundreds of millions of dollars. He also said that during the investigation, IP addresses and email accounts based in Russia were identified. Furthermore, he explained that DarkSide is not found in systems using Russian or Eastern European languages.

Colonial announced on the 7th that it had been hit by a ransomware attack from an unknown hacker group and had suspended all system operations. On the 9th, Colonial Pipeline said that some small lines had resumed operation but emphasized that safety must be confirmed before the entire system can be restarted. Additionally, it stated that federal regulatory approval must be obtained for full system operation. Colonial also said it is cooperating with the Federal Bureau of Investigation (FBI) and the Department of Homeland Security.

The hacker group was confirmed to have stolen 100 gigabytes of data from Colonial's network within two hours. Colonial Pipeline transports over 100 million gallons of energy resources, including gasoline, daily from Houston, Texas, to the Port of New York. Given the disruption to this large-scale energy transportation system, the White House responded immediately.

The White House formed a task force to respond to the situation and said the task force worked nonstop over the weekend. It also explained that the task force is reviewing various measures to minimize the impact of this incident.