Hacking

Subterms

    More stories

    • 163 Shares159 Views

      in US Politics

      ‘Lives are at stake’: hacking of US hospitals highlights deadly risk of ransomware

      by

      ‘Lives are at stake’: hacking of US hospitals highlights deadly risk of ransomwareThe number of ransomware attacks on US healthcare organizations increased 94% from 2021 to 2022, according to one report Last week, the US government warned that hospitals across the US have been targeted by an aggressive ransomware campaign originating from North Korea since 2021. Ransomware hacks, in which attackers encrypt computer networks and demand payment to make them functional again, have been a growing concern for both the private and public sector since the 90s. But they can be particularly devastating in the healthcare industry, where even minutes of down time can have deadly consequences, and have become ominously frequent.The number of ransomware attacks on healthcare organizations increased 94% from 2021 to 2022, according to a report from the cybersecurity firm Sophos. More than two-thirds of healthcare organizations in the US said they had experienced a ransomware attack in 2021, the study said, up from 34% in 2020.Ransomware attacks on healthcare are particularly common in the US, with 41% of such attacks globally having been carried out against US-based firms in 2021.“The current outlook is terrible,” said Israel Barak, CISO of Cybereason. “We are seeing the industry experience an extremely sharp increase in both the quantity and level of sophistication of these attacks.”Ransomware hacks have caused major healthcare disruptions, including delayed chemotherapy treatments and ambulances being diverted from a San Diego emergency room after computer systems were frozen. In 2021, a lawsuit filed by the mother of a baby who died in Alabama alleged the first “death by ransomware”, blaming a 2019 hack of a hospital for fatal brain damage of the newborn after heart rate monitors failed.‘We are not ready’: a cyber expert on US vulnerability to a Russian attackRead moreThe possibly devastating consequences for medical facilities may be one of the reasons hackers have identified them as a high-profile target. “The North Korean state-sponsored cyber actors likely assume healthcare organizations are willing to pay ransoms because these organizations provide services that are critical to human life and health,” said the advisory from the Cybersecurity and Infrastructure Security Agency (CISA).CISA and others advise hospitals against paying ransoms, but providers often feel they have no choice, said Barak. In 2021, 61% of healthcare organizations that suffered a ransomware attack paid the ransom – the highest percentage of any industry sector.“When lives are at stake, it makes the decision very easy,” Barak said. “These attackers have identified medical organizations as very, very good targets because they are more likely to pay.”Attacks are typically carried out by private groups of criminals, experts say: in the third quarter of 2021, 30% of ransomware attacks on healthcare entities were carried out by Conti, a crime syndicate thought to be based in Russia, according to an industry report from cybersecurity firm BreachQuest.But the North Korea incident revealed last week is just the latest state actor to orchestrate ransomware attacks on health care organizations after the FBI revealed in June it had thwarted an attack from Iran on a Boston Children’s hospital.Underfunded hospitals hit by Covid squeezeThe healthcare industry has been hit by a perfect storm of factors that have escalated the ransomware problem, experts say: patient information is increasingly being digitized as hospitals struggle with small internet security budgets.In 2009, the Obama administration passed a bill requiring all public and private healthcare providers to adopt electronic medical records by 2014, resulting in a massive migration of paper patient records to online systems. But today, just 4-7% of the average healthcare provider’s annual IT budget is focused on cybersecurity, the BreachQuest study said.“Healthcare providers have gone through massive digital transformation in a very short amount of time,” said Hank Schless, senior security expert at the cybersecurity firm Lookout.The move was accelerated by the pandemic, he added, as more providers shifted to telehealth to connect with patients during lockdown and hospital staff were stretched thin by the influx of sick and dying patients.CISA has advised a “3-2-1 backup approach” for healthcare entities, including saving three copies of each type of data in two different formats, including one offline. But the agency’s advisory to hospitals is “somewhat unhelpful”, said Vincent Berk, chief security officer at the cybersecurity firm Quantum Xchange, offering generic recommendations about securing data with little clear path to doing so.“The issue with this attack, and any other ransomware attack, is that the cure doesn’t really exist,” he said. “In other words, if it happens, it is already too late.”Legislators are attempting to fill in those gaps. In May, Senator Patty Murray of Washington led a hearing on strengthening cybersecurity in the healthcare and education sectors, saying that the US “needs to address cybersecurity attacks and ensure they are treated like the national security threat they are”.“These kinds of challenges don’t just cause major headaches, lawsuits, and expenses for hospitals,” she said. “They put patients in danger. They undermine our national security. And in some cases they even cost lives.”In March 2022 the Senate introduced a bipartisan bill called the Healthcare Cybersecurity Act, which would direct CISA and the Department of Health and Human Services (HHS) to collaborate on a plan to bolster cybersecurity measures among healthcare and public health organizations.Those measures would include cybersecurity training to employees of health organizations and authorize studies from CISA to identify risks in the industry. It is unclear when the bill is set for a vote, but experts say such legislation is more urgent than ever.“There’s zero deterrence right now,” Barak said. “Until we find a more effective way to tackle this issue, I am afraid the outlook is not looking good.”TopicsHackingHealthcare industryData and computer securityCybercrimeUS politicsUS healthcarenewsReuse this content More

    • 138 Shares109 Views

      in US Politics

      White House contacts Russia after hack of world’s largest meatpacking company

      by

      A ransomware attack against the world’s largest meatpacking company that has disrupted meat production in North America and Australia originated from a criminal organization probably based in Russia, the White House was informed on Tuesday.The attack on Brazil’s JBS caused its Australian operations to shut down on Monday and has stopped livestock slaughter at its plants in several US states.The ransomware attack follows one last month on Colonial Pipeline, the largest fuel pipeline in the United States, that crippled fuel delivery for several days in the US south-east.The White House spokeswoman Karine Jean-Pierre said JBS had given details of the hack to the White House, that the United States had contacted Russia’s government about the matter and that the FBI was investigating.“The White House has offered assistance to JBS and our team at the Department of Agriculture have spoken to their leadership several times in the last day,” Jean-Pierre said.“JBS notified the administration that the ransom demand came from a criminal organization likely based in Russia. The White House is engaging directly with the Russian government on this matter and delivering the message that responsible states do not harbor ransomware criminals,” Jean-Pierre added.If the outages continue, US consumers could see higher meat prices during summer grilling season and meat exports could be disrupted at a time of strong demand from China.JBS said it suspended all affected systems and notified authorities. It said its backup servers were not affected.“On Sunday, May 30, JBS USA determined that it was the target of an organised cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems,” the company said in a Monday statement.“Resolution of the incident will take time, which may delay certain transactions with customers and suppliers,” the company’s statement said.The company, which has its North American operations headquartered in Greeley, Colorado, controls about 20% of the slaughtering capacity for US cattle and hogs, according to industry estimates.Two kill and fabrication shifts were canceled at JBS’s beef plant in Greeley due to the cyber-attack, representatives of the United Food and Commercial Workers International Union Local 7 said in an email. JBS Beef in Cactus, Texas, also said on Facebook it would not run on Tuesday – updating an earlier post that had said the plant would run as normal.JBS Canada said in a Facebook post that shifts had been canceled at its plant in Brooks, Alberta, on Monday and one shift so far had been canceled on Tuesday.A representative in São Paulo said the company’s Brazilian operations were not affected. More

    • 138 Shares169 Views

      in US Politics

      Biden to unveil Russia sanctions over SolarWinds hack and election meddling

      by

      The US is set to announce new sanctions against Russia as soon as Thursday in retaliation for Moscow’s elections interference, alleged bounties on US soldiers in Afghanistan, and cyber-espionage campaigns such as the SolarWinds hack, according to reports in US and international media.Ten Russian diplomatic officials are to be expelled from the US and up to 30 entities will be blacklisted, officials said, in the largest sanctions action against Russia of Joe Biden’s presidency.Additionally, the White House may issue an executive order barring US financial institutions from purchasing rouble bonds issued by Russia’s government, targeting the country’s sovereign debt and its broader economy. That could begin as soon as June, according to some reports.Q&AWhat was the SolarWinds hack?ShowIn early 2020, malicious code was sneaked into updates to a popular piece of software called Orion, made in the US by the company SolarWinds, which monitors the computer networks of businesses and governments for outages.That malware gave hackers remote access to an organisation’s networks so they could steal information. Among the most high-profile users of the software were US government departments including the Centers for Disease Control and Prevention, the state department, and the justice department.Described by the Microsoft president, Brad Smith, as “the largest and most sophisticated attack the world has ever seen”, US intelligence agencies have accused Russia of launching the attack.SolarWinds, of Austin, Texas, provides network monitoring and other technical services to hundreds of thousands of organisations around the world, including most Fortune 500 companies and government agencies in North America, Europe, Asia and the Middle East.Its compromised product, Orion, is a centralised monitoring tool that looks for problems in an organisation’s computer network, which means that breaking in gave the attackers a “God view” of those networks.Neither SolarWinds nor US cybersecurity authorities have publicly identified which organisations were breached. Just because a company or agency uses SolarWinds as a vendor does not necessarily mean it was vulnerable to the hack.Kari Paul and Martin BelamUnnamed officials told the New York Times the new sanctions were meant to cut deeper than previous attempts to punish Moscow for its attacks on US institutions and allies. Some Russian officials have laughed off being added to the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctions lists, comparing it to being elevated to an elite club. The threat of the ban on purchasing Russian debt has already depressed prices on the rouble and rouble-denominated OFZ treasury bonds.The sanctions will add tension to an already strained relationship between Russia and the US. Since last month, Moscow has been engaged in the largest troop buildup on its border with Ukraine since the 2014 annexation of Crimea, provoking fears of an invasion. Biden called Vladimir Putin on Tuesday to urge him to de-escalate tensions with Ukraine and proposed a summit in a third country. The Kremlin gave a frosty account of the telephone call, and did not say whether Putin had agreed to the meeting.Earlier this year, Biden had agreed with a reporter when asked if Putin was “a killer”. Those remarks were replayed widely on Russian television. Putin responded by wryly wishing Biden “good health”, which was seen as a nod to Biden’s age.The US president’s tough approach differs considerably from that of the Trump administration, which largely sought to avoid confronting Russia over a CIA assessment that Moscow had offered and paid bounties for foreign fighters to kill US troops in Afghanistan. Trump said he doubted the evidence behind the reports.He similarly sided with Putin over an FBI assessment that Russia had interfered in the 2016 elections during a summit in Helsinki two years later.The planned sanctions were said to be retaliation for Russian interference in the 2020 elections, during which US intelligence agencies concluded that the Kremlin had backed Trump over Biden.Sign up for the Guardian’s First Thing newsletterThe sanctions would also be a response to a massive and sophisticated cybersecurity breach against SolarWinds Corp that affected software used by US government agencies. The US has blamed Russia for the attack.Peskov this week said that “the hostility and unpredictability of America’s actions force us in general to be prepared for the worst scenarios”. More

    • 138 Shares129 Views

      in US Politics

      Biden mulls punishments for Russia over suspected role in government hack

      by

      As president-elect Joe Biden weighed options to punish Russia for its suspected hacking of US government agencies and companies, one leading Republican accused Moscow of “acting with impunity” and others called for retaliatory strikes.Biden’s choices once he assumes office on 20 January range from financial sanctions to revenge cyberattacks on Russian interests, according to transition team sources. Donald Trump, meanwhile, maintains the hacking could be the work of China, despite the certainty of his own secretary of state, Mike Pompeo that Russia was behind the attacks.On Sunday, Republican senator Mitt Romney – a frequent Trump critic – said Vladimir Putin’s government had effectively invaded America.“What this invasion underscores is that Russia acted with impunity,” Romney told NBC’s Meet the Press. “They didn’t fear what we would be able to do from a cyber capacity. They didn’t think that our defence systems were particularly adequate. And they apparently didn’t think that we would respond in a very aggressive way.“This demands a response, and the response you’d expect to occur would be a cyber response. I don’t know if we have the capacity to do that in a way that would be of the same scale or even greater scale than what Russia has applied to us, but this is something we have to address as soon as possible.”John Barasso, a Republican senator from Wyoming, told Fox News Sunday the US had been “blindsided”.“Six different agencies have been attacked in our government and this has been going on since March,” he said. “We need to have a forceful, effective punishing response so people pay a price for this and think twice about doing it again.”Any response is unlikely to come in Trump’s 31 remaining days in the White House. Other than a critical tweet on Saturday, Trump has kept silent regarding the hack.“I think we’ve come to recognise that the president has a blind spot when it comes to Russia,” Romney, a member of the Senate homeland security committee, told CNN’s State of the Union. “But I think that the president-elect is a clear-eyed, intelligent individual and he’s going to assess Russia and their capabilities in an appropriate way.”Mark Warner of Virginia, the leading Democrat on the Senate intelligence committee, told ABC’s This Week: “When the president of the United States tries to deflect or is not willing to call out the adversary as we make that attribution, he is not making our country safer.“I sometimes think we disproportionately spend on tanks, ships and guns when we should be better protecting on cyber. And there are international implications of this attack as well. We need to be very clear with an affirmative cyber doctrine that says [if] you do this kind of broad-based, indiscriminate attack, you will bear the consequences.”A Biden source told Reuters the new president could step up counter cyber-espionage, with the goal of deterrence and diminishing the potency of Russian cyber spying. But Biden’s team will need better intelligence. Access to presidential briefings was delayed until about three weeks ago as Trump disputed election results.On Sunday, incoming White House chief of staff Ron Klain told CBS’s Face the Nation: “We should be hearing a clear and unambiguous allocation of responsibility from the White House, from the intelligence community. They’re the people in charge. They’re the ones who should be making those messages and delivering the ascertainment of responsibility.“Instead, what we’ve heard is one message from the secretary of state, a different message from the White House, a different message from the president’s Twitter feed. We have been briefed on this. But again, I think in terms of publicly communicating the position of our government that has to come from the current government and it should be coming in a clear and unambiguous voice.”Romney likened Russia’s suspected attack to the US assault on Baghdad during the Iraq war in 2003.“You saw the videos of the rockets going across the city and slamming into various buildings and the places they attacked, of course, were the communication centers and the utility centers,” he told NBC. “You can bring a country to its knees if people don’t have electricity, don’t have water and can’t communicate.“Basically what Russia appears to have done [is] put themselves in those systems in our country. They don’t need rockets to take those things out. They potentially have the capability to take out all of those things remotely at very small cost.”Christopher Krebs, fired by Trump last month as director of the US Cybersecurity and Infrastructure Security Agency (Cisa) for publicly debunking the president’s false claims of election fraud, agreed that the hack was likely the work of the Russian foreign intelligence service SVR. But he doubted Romney’s assessment about what Russia might do with the harvested data.“The [SVR] are intelligence collectors,” Krebs told CNN. “They’re looking for policy decisions, they’re looking for diplomatic negotiations in federal agencies. They’re typically not the ones to run the destructive types of attacks, and they typically don’t work with the other parts of the Russian government.“That doesn’t mean they can’t hand off access, but for now I think this is more of a intelligence collection operation. The thing that really concerns me about this particular campaign by the Russians was the indiscriminate nature of the supply chain targeting, the fact that they have potentially compromised 18,000 companies. That to me is outside of the bounds of what we’ve seen recently of espionage activities.”Klain echoed Krebs’ caution about what Russia might be hoping to achieve, but added: “In terms of the measures that a Biden administration would take in response to an attack like this, I want to be very clear. It’s not just sanctions. It’s also steps and things we could do to degrade the capacity of foreign actors to repeat this sort of attack.” More

    • 188 Shares159 Views

      in US Politics

      What we know – and still don’t – about the worst-ever US government cyber attack

      by

      Nearly a week after the US government announced that multiple federal agencies had been targeted by a sweeping cyber attack, the full scope and consequences of the suspected Russian hack remain unknown.Key federal agencies, from the Department of Homeland Security to the agency that oversees America’s nuclear weapons arsenal, were reportedly targeted, as were powerful tech and security companies, including Microsoft. Investigators are still trying to determine what information the hackers may have stolen, and what they could do with it.Donald Trump has still said nothing about the attack, which federal officials said posed a “grave risk” to every level of government. Joe Biden has promised a tougher response to cyber attacks but offered no specifics. Members of Congress are demanding more information about what happened, even as officials scrambling for answers call the attack “significant and ongoing”.Here’s a look at what we know, and what we still don’t, about the worst-ever cyber attack on US federal agencies.What happened?The hack began as early as March, when malicious code was snuck into updates to a popular software called Orion, made by the company SolarWinds, which provides network-monitoring and other technical services to hundreds of thousands of organizations around the world, including most Fortune 500 companies and government agencies in North America, Europe, Asia and the Middle East.That malware in the updates gave elite hackers remote access to an organization’s networks so they could steal information. The apparent months-long timeline gave the hackers ample opportunity to extract information from many targets, including monitoring email and other internal communications.Microsoft called it “an attack that is remarkable for its scope, sophistication and impact”.Who has been affected so far?At least six US government departments, including the energy, commerce, treasury and state departments, are reported to have been breached. The National Nuclear Security Administration’s networks were also breached, Politico reported on Thursday.Dozens of security and other technology firms, as well as non-governmental organizations, were also affected, Microsoft said in a statement Thursday. While most of those affected by the attack were in the US, Microsoft said it had identified additional victims in Canada, Mexico, Belgium, Spain, the United Kingdom, Israel and the United Arab Emirates.“It’s certain that the number and location of victims will keep growing,” Microsoft added.Who is responsible for the attack?While the US government has not yet officially named who is responsible for the attack, US officials have told media outlets they believe Russia is the culprit, specifically SVR, Russia’s foreign intelligence outfit.We must act as if the Russian government has control of all the networks it has penetratedAndrei Soldatov, an expert on Russia’s spy agencies and the author of The Red Web, told the Guardian he believes the hack was more likely a joint effort of Russia’s SVR and FSB, the domestic spy agency Putin once headed.Russia has denied involvement: “One shouldn’t unfoundedly blame the Russians for everything,” a Kremlin spokesman said on Monday.The infiltration tactic involved in the current hack, known as the “supply-chain” method, recalled the technique Russian military hackers used in 2016 to infect companies that do business in Ukraine with the hard-drive-wiping NotPetya virus – the most damaging cyber-attack to date.What information has been stolen, and how is it being used?That’s remains deeply unclear.“This hack was so big in scope that even our cybersecurity experts don’t have a real sense yet in the terms of the breadth of the intrusion itself,” Stephen Lynch, the head of the House of Representatives’ oversight and reform committee, said after attending a classified briefing Friday.Thomas Rid, a Johns Hopkins cyberconflict expert, told the Associated Press that it was likely that the hackers had harvested such a vast quantity of data that “they themselves most likely don’t know yet” what useful information they’ve stolen.What can be done to fix the networks that have been compromised?That’s also unclear, and potentially very difficult.“Removing this threat actor from compromised environments will be highly complex and challenging for organizations,” said a statement from the Cybersecurity and Infrastructure Security Agency (Cisa) on Thursday.One of Trump’s former homeland security advisers, Thomas Bossert, has already said publicly that a real fix may take years, and be both costly and challenging.“It will take years to know for certain which networks the Russians control and which ones they just occupy,” Bossert wrote in a New York Times op-ed on Wednesday. “The logical conclusion is that we must act as if the Russian government has control of all the networks it has penetrated.”“A ‘do-over’ is mandatory and entire new networks need to be built – and isolated from compromised networks,” he wrote.How has Trump responded?As of Friday afternoon, the US president had still said nothing to address the attack.The Republican senator and former presidential candidate Mitt Romney has criticized Trump’s silence as unacceptable, particularly in response to an attack he said was “like Russian bombers have been repeatedly flying undetected over our entire country”.“Not to have the White House aggressively speaking out and protesting and taking punitive action is really, really quite extraordinary,” Romney said.How has Biden responded?So far, there’s been tough talk but no clear plan from the president-elect.“We need to disrupt and deter our adversaries from undertaking significant cyberattacks in the first place,” Biden said. “We will do that by, among other things, imposing substantial costs on those responsible for such malicious attacks, including in coordination with our allies and partners.”“There’s a lot we don’t yet know, but what we do know is a matter of great concern,” Biden said.Could this attack have been prevented or deterred?“What we could have done is had a coherent approach and not been at odds with each other,” said Fiona Hill, a Russia expert and former Trump National Security Council member, to PBS NewsHour this week, criticizing conflict and dysfunction within the Trump administration and between the US and its allies on Russia-related issues.If “we don’t have the president on one page and everybody else on another, and we’re working together with our allies to push back on this, that would have a serious deterrent effect”, Hill said.Other cybersecurity experts said the federal government could also do more to simply keep up to date on cybersecurity issues, and said the Trump administration had failed on this front, including by eliminating the positions of White House cybersecurity coordinator and state department cybersecurity policy chief.“It’s been a frustrating time, the last four years. I mean, nothing has happened seriously at all in cybersecurity,” said Brandon Valeriano, a Marine Corps University scholar and adviser to a US cyber defense commission, to the Associated Press.What options does the US have to respond politically to this kind of attack?Some experts are arguing that the US government needs to do more to punish Russia for its apparent interference. The federal government could impose formal sanctions on Russia, as when the Obama administration expelled Russian diplomats in retaliation for Kremlin military hackers’ meddling in Donald Trump’s favor in the 2016 election. Or the US could fight back more covertly by, for instance, making public details of Putin’s own financial dealings.But, as the Guardian’s Luke Harding pointed out, cyber attacks are “cheap, deniable, and psychologically effective”, and Biden’s options for responding to Russia’s aggression are limited.“The answer eluded Barack Obama, who tried unsuccessfully to reset relations with Putin. The person who led this doomed mission was the then secretary of state, Hillary Clinton, herself a Russian hacking victim in 2016,” Harding wrote.What are other potential consequences of the hack?SolarWinds may face legal action from private customers and government entities affected by the breach. The company filed a report with the Securities and Exchange Commission on Tuesday detailing the hack.In it, the company said total revenue from affected products was about $343m, or roughly 45% of the firm’s total revenue. SolarWinds’ stock price has fallen 25% since news of the breach first broke.Moody’s Investors Service said Wednesday it was looking to downgrade its rating for the company, citing the “potential for reputational damage, material loss of customers, a slowdown in business performance and high remediation and legal costs”.The Associated Press contributed reporting. More

    • 200 Shares129 Views

      in US Politics

      Orion hack exposed vast number of targets – impact may not be known for a while

      by

      If there is one silver lining to the months-long global cyber-espionage campaign discovered when a prominent cybersecurity firm learned it had been breached, it might be that the sheer numbers of potentially compromised entities offers them some protection.By compromising one piece of security software – a security tool called Orion developed by the Texan company SolarWinds – the attackers gained access to an extraordinary array of potential targets in the US alone: more than 425 of the Fortune 500 list of top companies; all of the top 10 telecommunications companies; all five branches of the military; and all of the top five accounting firms.But they are just a fraction of SolarWinds’ 300,000 global customers, which also include UK government agencies and private sector companies.For now, we only have only confirmation from investigators that the US Treasury and commerce departments were attacked. The hack, attributed to Russian state actors, took the form of a so-called supply chain attack. Rather than directly attacking the US government, the attackers succeeded in compromising the automatic update function built into Orion.That breach provided the foothold the attackers needed to begin monitoring internal emails at the departments. By hacking SolarWind and inserting weaknesses into the Orion software at source, the attackers simply had to wait until their targets downloaded and ran a fake software security update.Thankfully, even then, the full attack was a technically challenging manoeuvre. In order to stay below the radar of the US government’s own security teams, the update was programmed to sit silently for two weeks after it was installed, and then to only upload stolen data in small quantities so that it could be disguised as normal Orion traffic.That, investigators say, means it is unlikely that the perpetrators made the most of the widespread access they could have gained. Rather than exfiltrating untold gigabytes of stolen data to peruse at their leisure, the attackers had to operate in a much more labour-intensive fashion, navigating through the government network as quietly as possible, and only uploading data already presumed to be valuable.At the moment it is not clear how much information was taken, and what other departments and entities the hackers chose to enter.Nevertheless, the US Cybersecurity and Infrastructure Security Agency issued an emergency directive late on Sunday night advising all federal civilian agencies to “review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately”. The acting director, Brandon Wales, said the compromise “poses unacceptable risks” to the security of federal networks.The long-term impact of the hack is unlikely to be known for a while, if at all. Although journalists and the public think about the impact of attacks simply in terms of any striking secrets revealed, cyber-warfare tends to have multiple goals.As well as looking for ill-guarded secrets of individuals, this sort of attack can be used to map how organisations work and their structural vulnerabilities, with a view to potentially exploiting them at a later point..More broadly, cyber operations like this undermine confidence in existing security measures and hand a propaganda coup to the country directing the attack.Silently eavesdropping on high-value targets is a labour-intensive job – particularly if the attacker wants to stay hidden, and for now it appears that the temptation to eavesdrop on internal communications at the US treasury and commerce departments was the most compelling.If other customers of SolarWinds do not find evidence that they were under surveillance, they will take solace in the fact that the US government was too big a target to pass up. More