Feds Investigate Cyberattack on U.S. Power Plants

Malware that may have originated in Russia has been targeting the computer networks of nuclear power plants and other industrial sites in the U.S., according to federal officials.

Shutterstock

One of the targets is the Wolf Creek nuclear power plant near Burlington, Kan., according to a report from the Department of Homeland Security and FBI obtained by the New York Times.

The malware appears to come from several phishing campaigns, according to the report. Hackers created fake resumes for engineering control jobs, laced them with malicious code, and sent them to engineers with access to the critical systems that control industrial infrastructure. They also compromised legitimate websites that engineers were likely to visit, according to the report.

Some attempts also involved man-in-the-middle attacks, in which the hackers redirected the engineers' internet traffic through their own servers, the report said. The attacks occurred in early May, just as President Donald Trump signed an executive order to strengthen the nation's cybersecurity.

The report carried an amber warning, the second highest threat sensitivity rating, according to the Times. But the FBI and DHS still downplayed the threat.

"There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks," the agencies said in a joint statement to the Times.

Russian hackers are the chief suspects in the attacks, Bloomberg reported, citing U.S. officials who are investigating vulnerabilities in the electrical grid. The attacks bear a resemblance to malware that triggered a power outage in Ukraine last year. Ukrainian officials accused Russia of orchestrating that attack, which Moscow denied.

Russian officials also rejected the notion that the country was behind the recent U.S. attacks. "We don't pay attention to such anonymous fakes," a Kremlin spokesman told Bloomberg.