The DOJ charges four Russian officials for alleged hacking campaigns from 2012 to 2018 on critical US infrastructure, including a Kansas nuclear power plant
Saturday, March 26, 2022 // (IG): BB //Weekly Sponsor: DiyGarage SoCal Gary Warner / CyberCrime & Doing Time : Russia's Invasion of Ukraine and CISA/FBI's New Era of Transparency Cynthia Brumfield / Metacurity : Four Russian Officials Charged With Hacking Critical Infrastructure Lisa Vaas / Threatpost : DOJ Indicts Russian Gov't Employees Over Targeting Power Sector Jai Vijayan / Dark Reading : Indictment of Russian National Offers Glimpse Into Methodical Targeting of Energy Firm Pierluigi Paganini / Security Affairs : US indicted 4 Russian government employees for attacks on critical infrastructure Lucian Constantin / CSO : US charges Russian government agents for cyberattacks on critical infrastructure Carly Page / TechCrunch : US charges four Russian spies for hacking Saudi oil facility and US nuclear power plant Steve Zurier / SC Media : Advisory issued as DoJ indicts Russian nationals for cyberattacks on critical infrastructure CISA : Alert (AA22-083A) — Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian … File411's Newsletter : I am taking a few days off -I will see you on the 28th Rob Pegoraro / PCMag : Department of Justice Reminds Us Russian Hackers Are a Serious Threat PYMNTS.com : Russian Government Employees Charged in Worldwide Hacking Scheme Ravie Lakshmanan / The Hacker News : U.S. Charges 4 Russian Govt. Employees Over Hacking Critical Infrastructure Worldwide Agence France-Presse : Four Russians Indicted In US For Energy Sector Hacks Reuters : Russian Agents Charged With Targeting US Nuclear Plant, Saudi Oil Refinery Andy Greenberg / Wired : Feds Allege Destructive Russian Hackers Targeted US Refineries Tweets: Jeff Stone / @jeffstone500 : details in these charges help answer why there hasn't been louder cyberwar since Russia invaded Ukraine. one of many reasons: it's a lot of work to launch a destructive attack. it took three years of prep to build malware that disrupted safety systems. https://www.justice.gov/... https://twitter.com/... @emptywheel : One thing I can't get over about yesterday's hacking indictment announcement. AUSA Luke Jones is one of the prosecutors on the Gladkikh indictment. https://www.justice.gov/... https://twitter.com/... @mandiant : Charges against Russian officials targeting critical infrastructure back to 2012 come days after President Biden's warnings of potential cyber attacks from Moscow. One of these attacks, @JohnHultquist tells @NYTimes, signaled a leap in what was possible. https://www.nytimes.com/... Robert M. Lee / @robertmlee : I'm glad CISA is providing a companion document w/ the DOJ indictment of the Russian govt operators who targeted ICS. Lots of great info but please don't follow their mitigation advice for ICS. It's not practical & in some cases dangerous. A quick thread: https://us-cert.cisa.gov/... Josh Mankiewicz / @joshmankiewicz : The announcement covered hackings from 2012 to 2018, but served as yet another warning from the Biden administration of Russia's ability to conduct such operations. https://www.nytimes.com/... @cisagov : With the @FBI and @DOE_CESER, we issued an advisory on energy sector facility intrusions from 2011-2018: https://us-cert.gov/... This historical info highlights the need to go Shields Up against this & other potential Russian state-sponsored activity: https://cisa.gov/... https://twitter.com/... Kim Zetter / @kimzetter : Justice Dept unseals indictment charging Russian hacker - Evgeny Viktorovich Gladkikh - with orchestrating Triton hack that struck a Saudi petro-chemical plant in 2017. Triton was first-of-its kind attack aimed at subverting the safety system at a refinery https://www.justice.gov/... @thejusticedept : Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide Defendants' Separate Campaigns Both Targeted Software and Hardware for Operational Technology Systems https://www.justice.gov/... https://twitter.com/... Cliff Levy / @cliffordlevy : 3 officers from the FSB, the Kremlin's security service, are accused of hacking the Wolf Creek Nuclear Operating Corporation, which runs a nuclear plant in Kansas. They are also charged with hacking hundreds of other energy businesses around the world. https://www.nytimes.com/...
Context & Ripple Effects
The DOJ had already tied Russian intelligence personnel to the 2014 Yahoo breach in a prior indictment of Russian intelligence-linked defendants. Related coverage also documented Russian targeting of the US power grid and reported that US Cyber Command had placed offensive malware in Russia's grid, placing these charges within an increasingly public cyber confrontation.
First-order effects
- Four Russian government employees are now formally accused by the DOJ over campaigns aimed at US critical infrastructure, including the Wolf Creek nuclear plant in Kansas.
- The indictment puts the alleged targeting of energy infrastructure into a criminal case rather than leaving it solely as an intelligence or incident-response concern.
Second-order effects
- The DOJ's case strengthens the public record connecting Russian government personnel to infrastructure targeting that earlier coverage traced across the US power grid.
- US cyber policy is further framed through both legal attribution and operational pressure, alongside the reported Cyber Command presence in Russia's power grid.
Third-order effects
- If this pattern persists, state cyber conflict will be managed increasingly through parallel channels: criminal indictments to publicly assign responsibility and cyber operations to impose strategic costs.
- Critical-infrastructure operators will face a security environment in which energy networks are not only operational targets but also central evidence in interstate cyber disputes.
The trend: The US is making alleged state-backed infrastructure hacking more visible through criminal attribution while treating cyber conflict as a sustained strategic contest.