Joseph Marks | Nextgov | March 21, 2017 | 0 Comments

Once Stealthy, Russian Hackers Now Go Toe to Toe with U.S. Defenders

Natacha Pisarenko/AP

Editor's note: This article was updated April 3 to clarify when the NSA engaged in the defense of the unclassified network. Click here for more details.

In 2014, an adversary nation-state’s hackers cracked into one of the U.S. government’s unclassified national security systems and set about extracting information. That’s nothing out of the ordinary.

When the U.S. government network defenders discovered the hackers, however, instead of taking flight as they normally do, the attackers stuck around and fought back.

That was a first, National Security Agency Deputy Director Richard Ledgett said during an Aspen Institute discussion Tuesday.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

“It was basically hand-to-hand combat within a network,” Ledgett said. “We would take an action; they would then counter that. We’d remove their command and control channel to the malware. … They’d counter that by introducing a new command and control channel.”

NSA’s network defenders were aided in their fight by intelligence gleaned by the agency’s offensive hackers and other signal intelligence, Ledgett said, which reported on preparations the adversary nation hackers were making inside their own networks. The NSA team succeeded—eventually—in expelling the hackers from the U.S. government computer systems.

“It was about a 24-hour period of parry-riposte, parry-riposte, measure, countermeasure and so forth,” he said. “That was new. That’s a new level of interaction between a cyberattacker and a defender. … It was a little bit of a game changer.”

Ledgett did not name the adversary nation, but Russia is, by far, the likeliest possibility. He also did not name the breached system. 

The exchange highlights the increasingly hot cyber conflict between the U.S. and its Russian adversaries that began ramping up well before the release of reams of sensitive emails stolen from the Democratic National Committee and the Hillary Clinton campaign that bedeviled the 2016 election contest.

FireEye CEO Kevin Mandia traces a major shift to about August 2014 when his company responded to a breach of a U.S. government agency. Instead of retreating as they normally do when investigators pop onto the breached network, Mandia said, the Russian government-linked hackers stuck around.

“They knew we were observing them, but didn’t go away,” Mandia said during a recent breakfast with reporters before a FireEye conference. “That was different … something changed then.”

Russian hackers also began spending less time cleaning up traces of their operation around then, he said, leaving clues they formerly would have erased.

Mandia declined to name the hacked organization. The timing makes breaches of the State Department and White House unclassified email systems a possibility.

Mandia described the shift in tactics as the beginning of a series of changes that included increased targeting of anti-Putin academics and eventually the release of hundreds of emails damaging to the Clinton campaign. The shift may not have reached its conclusion, he said.  

“I sit here wondering, throughout my career, how many emails do I think the Russian government has stolen and how many of them have been posted online,” he said. “I would argue they’ve probably posted far less than 1 percent of 1 percent.”

That concern has been echoed since late 2016 by numerous lawmakers and members of the Obama administration who fear Putin will meddle in future U.S. elections if there are not additional consequences for his 2016 actions.

Also during Tuesday’s Aspen event, Ledgett firmly denied the suggestion by President Donald Trump and White House Press Secretary Sean Spicer that Britain’s spy agency GCHQ might have helped the Obama administration wiretap Trump Tower during the presidential campaign, calling it “categorically not realistic.”

Ledgett noted Trump and Spicer have both said they were quoting the speculation of a Fox News analyst rather than opining on their own behalf.

“They’d refuse to do it if asked, but they wouldn’t be asked,” he said, noting both nations' spy agencies are barred from helping the other break domestic laws.

Ledgett’s boss, NSA Director Adm. Michael Rogers, and FBI Director James Comey both testified Monday that there’s no evidence to support Trump’s claim that the Obama administration wiretapped Trump tower, a refutation supported by Republican and Democratic leaders of both congressional intelligence committees.


Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.