Hackers exploited a vulnerability in software created by Texas technology firm SolarWinds and inserted malicious code. The software called Orion was designed to monitor computer networks for security flaws. While investigators into the attack have been reticent to name the entity behind the hacking, Pompeo said during a Friday interview on The Mark Levin Show that Russia was the main suspect.
“I can’t say much more as we’re still unpacking precisely what it is, and I’m sure some of it will remain classified,” Pompeo said. “But suffice it to say there was a significant effort to use a piece of third-party software to essentially embed code inside of U.S. Government systems and it now appears systems of private companies and companies and governments across the world as well. This was a very significant effort, and I think it’s the case that now we can say pretty clearly that it was the Russians that engaged in this activity.”
Pompeo said that some information could not be revealed while the investigation into the attack was ongoing. “There are many things that you’d very much love to say, ‘Boy, I’m going to call that out,’” Pompeo said, “but a wiser course of action to protect the American people is to calmly go about your business and defend freedom.”
Newsweek reached out to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. State Department for comment.
House Intelligence Committee Chairman Adam Schiff called the event a “massive hack” Friday during an interview with CNN’s Chris Cuomo.
Schiff said the cyber incursion affected “our national security infrastructure, our critical infrastructure, both private and public sectors.” Schiff added it could take “perhaps even months” to ascertain how widespread the attack was. Because of the intricacies of the attack, it could take months to purge the malicious code from the breached systems.
SolarWinds listed among its client base the U.S. Air Force, the U.S. Department of Defense and the U.S. Secret Service. A page on the SolarWinds website listing their high-profile clients has been removed.
Russia has denied any involvement in the attack. In a statement sent to Newsweek on Tuesday, the Russian embassy in Washington said that “Russia does not conduct offensive operations in the cyber domain.”
While President Donald Trump has yet to comment publicly on the attack, President-elect Joe Biden described the hack as a “matter of great concern” in a Thursday statement.
Biden said that his administration would deter cyber criminals by “imposing substantial costs on those responsible for such malicious attacks, including in coordination with our allies and partners. Our adversaries should know that, as President, I will not stand idly by in the face of cyber assaults on our nation.”
Investigations into the attack are being conducted by the Cyber Unified Coordination Group, a joint effort between CISA, the FBI and the Office of the Director of National Intelligence.
