A group of hackers backed by a foreign government have reportedly been monitoring internal email traffic at the US treasury department and an agency that decides internet and telecommunications policy.
There is concern within the US intelligence community that the hackers who targeted the treasury department and the commerce department’s national telecommunications and information administration used a similar tool to break into other government agencies, according to people familiar with the matter.
The people did not say which other agencies but it was reported that the hack was so serious it led to a national security council meeting at the White House on Saturday, said one of the people familiar with the matter.
The hack involves the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, the sources said.
The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.
“This is a nation-state,” said a different person briefed on the matter. “We just don’t know which one yet.“
The full scope of the hack is unclear. The investigation is still in its early stages and involves a range of federal agencies, including the FBI, according to the three people familiar with the matter.
“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said national security council spokesman John Ullyot.
Sources said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.
Last Tuesday, FireEye said that foreign government hackers with ‘world-class capabilities’ broke into its network and stole offensive tools it uses to probe the defenses of its thousands of customers. Those customers include federal, state, and local governments and top global corporations.
The FBI, the homeland security department’s cybersecurity division, known as CISA, and the US national security agency are yet to comment on the matter.