https://www.washingtonpost.com/world/national-security/russian-government-hackers-do-not-appear-to-have-targeted-vermont-utility-say-people-close-to-investigation/2017/01/02/70c25956-d12c-11e6-945a-76f69a399dd5_story.html?utm_term=.603827eb94fa&wpisrc=nl_headlines&wpmm=1
National Security Russian government hackers do not appear to have targeted Vermont utility, say people close to investigation The investigation by officials began Friday, when the Vermont utility reported its alert to federal authorities, some of whom told The Washington Post that code associated with the Russian hackers had been discovered within the system of an unnamed Vermont utility. (Kirill Kudryavtsev/AFP/Getty Images) By Ellen Nakashima and Juliet Eilperin January 2 at 10:02 PM As federal officials investigate suspicious Internet activity found last week on a Vermont utility computer, they are finding evidence that the incident is not linked to any Russian government effort to target or hack the utility, according to experts and officials close to the investigation. An employee at Burlington Electric Department was checking his Yahoo email account Friday and triggered an alert indicating that his computer had connected to a suspicious IP address associated by authorities with the Russian hacking operation that infiltrated the Democratic Party. Officials told the company that traffic with this particular address is found elsewhere in the country and is not unique to Burlington Electric, suggesting the company wasn’t being targeted by the Russians. Indeed, officials say it is possible that the traffic is benign, since this particular IP address is not always connected to malicious activity. The investigation by officials began Friday, when the Vermont utility reported its alert to federal authorities, some of whom told The Washington Post that code associated with the Russian hackers had been discovered within the system of an unnamed Vermont utility. On Friday evening, The Post published its report, and Burlington Electric released a statement identifying itself as the utility in question and saying the firm had “detected the malware” in a single laptop. The company said in its statement that the laptop was not connected to its grid systems. The Post initially reported incorrectly that the country’s electric grid had been penetrated through a Vermont utility. After Burlington Electric released its statement saying that the potentially compromised laptop had not been connected to the grid, The Post immediately corrected its article and later added an editor’s note explaining the change. U.S. officials are continuing to investigate the laptop. In the course of their investigation, though, they have found on the device a package of software tools commonly used by online criminals to deliver malware. The package, known as Neutrino, does not appear to be connected with Grizzly Steppe, which U.S. officials have identified as the Russian hacking operation. The FBI, which declined to comment, is continuing to investigate how the malware got onto the laptop. Officials say Russian government hackers do not appear to have targeted Vermont utility Play Video1:10 Officials say Russian government hackers do not appear to have targeted Burlington Electric, a Vermont utility. Editor’s Note: An earlier version of this video incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid. (Victoria Walker/The Washington Post) Initially, company officials publicly said they had detected code that had been linked by the Department of Homeland Security to Grizzly Steppe. Over the weekend, the company issued a statement, saying only that it had “detected suspicious Internet traffic” on the computer in question. The murkiness of the information underlines the difficulties faced by officials as they try to root out Grizzly Steppe and share with the public their findings on how the operation works. Experts say the situation was made worse by a recent government report, which they described as a genuine effort to share information with the industry but criticized as rushed and prone to causing confusion. Authorities also were leaking information about the utility without having all the facts and before law enforcement officials were able to investigate further.
