The FBI on Monday blamed a Russian criminal group suspected of being responsible for a cyberattack that shut down a major U.S. fuel pipeline, two sources familiar with the matter announced Sunday.
The government issued an emergency declaration for the event, which has already caused a rise in the price of gasoline.
The group, known as
DarkSide
, is relatively new, but has a sophisticated approach to the extortion business, according to sources.
Cybereason, a cybersecurity technology company, provided CNBC, sister network to Noticias Telemundo, with a new statement from the organization on Monday under the title
About the latest news
.
The group clarified that it is apolitical and that it only wants to make money without causing problems for society.
[Biden imposes sanctions on Russia for cyberattacks and election interference]
"We are apolitical, we do not participate in geopolitics, we do not need to link ourselves with a defined government and seek our motives," the statement said.
“Our goal is to make money and not create problems for society.
Starting today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future. "
Commerce Secretary Gina Raimondo said Sunday that the White House was working to help Colonial Pipeline, the Georgia-based company that operates the pipeline, restart its 5,500-mile (8,800-kilometer) network.
As a result of the cyber attack, gasoline prices rose by as much as 4.2% this Monday morning.
"If the pipeline is put into operation at the beginning of the week, the impact on prices should be limited," says Giovanni Staunovo, an analyst at UBS Global Wealth Management, in The New York Times.
"However, a prolonged shutdown (5 days or more) is likely to drive up gasoline prices, which are already trading near a 7-year high," he adds.
[Twenty years in power for longer: Vladimir Putin may rule Russia until 2036 after constitutional referendum]
The system, which runs from Texas to New Jersey, carries
45% of the East Coast's fuel supply
.
The company said in a statement Sunday that some smaller lateral lines were operational but that
the main lines were still not working.
"We are in the process of restoring service to other laterals and will bring our entire system back up and running only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations," the company said.
The federal government, on alert for a possible attack by Chinese hackers
March 4, 202100: 26
Raimondo noted on CBS's
Face the Nation
that the effort to restart the network was "an effort by all concerned at this time."
"We are working closely with the company and with state and local officials to make sure they get back to normal as soon as possible and there are no supply disruptions," he said.
"Unfortunately,
these types of attacks
are becoming more frequent.
They are here to stay," he
added.
A White House official said Sunday that the Department of Energy is leading the government's response.
The agencies are planning a series of scenarios in which the region's fuel supply is affected, the official said.
Colonial Pipeline on Saturday attributed the cyber attack to ransomware - a malicious program that restricts access to parts of the operating system and asks for a ransom in exchange for removing this restriction - and said some of its systems were affected.
The company said it "proactively" took "certain systems offline to contain the threat."
The company has not said what was required or who made the demand.
Although Russian hackers often work for the Kremlin, early indications suggest that
it is a criminal scheme
and not a nation-state attack, the sources said.
[The list of government agencies attacked by Russian hackers grows. This is what is known so far]
But the fact that Colonial has had to shut down the country's
largest gasoline pipeline
underscores how vulnerable America's cyberinfrastructure is to criminals and domestic adversaries such as Russia, China and Iran, experts say.
"This could be the
most shocking
ransomware
[data hijacking]
attack in
history
, a cyber disaster turning into a real-world catastrophe," said Andrew Rubin, CEO and co-founder of Illumio, a cybersecurity company.
Hackers use smart ringtones to get your information and make fake calls
Nov. 23, 202004: 55
"It's an absolute and recurring nightmare," Rubin said.
"Organizations keep relying on and investing everything in detection, as if they can prevent all breaches from happening. But this approach fails attacks time after time. Before the next inevitable breach occurs,
the President and Congress have to take action on our broken security model, "he
added.
[Tank truck driver shortage could put millions out of gas this summer]
If the culprit turns out to be a Russian criminal group, it will reveal that
Russia unleashes criminal hackers
targeting the West, said Dmitri Alperovitch, co-founder of cyber company CrowdStrike and CEO of think tank Silverado Policy Accelerator.
"Whether or not they work for the state is increasingly irrelevant, given
Russia's obvious policy of harboring and tolerating cybercrime,
" Alperovitch said.
DarkSide also maintains that it will donate a portion of its profits to charities, even though some of them have already rejected the contributions.
"No matter how bad you think our job is, we are pleased to hear that we help change someone's life," the hackers wrote.
"Today we send [sic] the first donations," they say.
According to a leading Reuters cybersecurity journalist, DarkSide has its own website on the
dark web
that features a series of leaked data from victims who it claims did not pay the ransom.
According to him, the group has made millions from cyber extortion.
With information from NBC News, CNN, The New York Times and CNBC.
