Bloomberg – by Michael Riley and Jordan Robertson
Russian hackers attacked the U.S. financial system in mid-August, infiltrating and stealing data from JPMorgan Chase & Co. (JPM) and at least one other bank, an incident the FBI is investigating as a possible retaliation for government-sponsored sanctions, according to two people familiar with the probe.
The attack resulted in the loss of gigabytes of sensitive data, said the people, who asked not to be identified because the probe is still preliminary. Authorities are investigating whether recent infiltrations of major European banks using a similar vulnerability are also linked to the attack, one of the people said.
In one case, the hackers used a software flaw known as a zero-day vulnerability in one of the banks’ websites. They then plowed through layers of elaborate security to steal the data, a feat security experts said appeared far beyond the capability of ordinary criminal hackers. The incidents occurred at a low point in relations between Russia and the West. Russian troops continue to mass on the Ukrainian border and the West tightens sanctions aimed at crippling Russian companies, including some of the country’s most important banks.
Government Link
The sophistication of the attack and technical indicators extracted from the banks’ computers provide some evidence of a government link. Still, the trail is muddy enough that investigators are considering the possibility that it’s cyber criminals from Russia or elsewhere in Eastern Europe. Other federal agencies, including the National Security Agency, are now aiding the investigation, a third person familiar with the probe said.
“The way the Russians do it, to the extent we can see into the process, is they encourage certain targets,” said James Lewis, director of the Strategic Technologies program at the Center for Strategic and International Studies in Washington. “The Russians typically keep open the options to do something more, and the question now is what would trigger that and what would our response be.”
J. Peter Donald, an FBI spokesman in New York, declined to comment.
‘Every Day’
“Companies of our size unfortunately experience cyber attacks nearly every day,” Patricia Wexler, a JPMorgan spokeswoman, said in an e-mail. “We have multiple, layers of defense to counteract any threats and constantly monitor fraud levels.”
JPMorgan fell 15 cents to $59.59 in New York trading today. The stock has risen 2 percent this year.
Related: Here’s a Hacker Attack That Will Make You Grind Your Teeth
Attacks on the U.S. financial sector from Russia and Eastern Europe have jumped over that last several months, according to several cyber security experts. Companies and U.S. officials are examining the possibility that the uptick is related to the conflict over Russia’s behavior in Ukraine.
In at least one of the attacks, the hackers grabbed sensitive data from the files of bank employees, including executives, according to a fourth person briefed on the probe, who, like the other individuals with knowledge of the matter, declined to divulge the name of victims other than JPMorgan. Some data related to customers may also have been accessed, the person said.
Russian Ire
U.S. and European sanctions have altered the way that Western banks interact with Russian entities over the past few months, triggering the ire of Russian officials. In April, JPMorgan was singled out for criticism when it blocked a payment from a Russian embassy to the affiliate of a U.S.-sanctioned bank. Russia’s foreign ministry called the move by New York-based JPMorgan “illegal and absurd.” The U.S. bank was widely criticized by Russian commentators.
ISight Partners, a Dallas-based company that provides intelligence on cyber threats to some of the largest banks, recently warned clients of the potential for retaliatory attacks in cyberspace as Western sanctions tightened.
Russia has used such attacks before. In conflicts with Estonia and Georgia, hackers crashed those countries’ communications systems and government websites.
’Reactionary Attacks’
“Russia has a policy of reactionary attacks in relation to political contexts,” said John Hultquist, an iSight expert who would not confirm direct knowledge of the attack. “When it comes to countries outside their sphere of influence, those attacks would be more surreptitious.”
Any U.S. reaction may be muted, even if the government makes a direct link from the attacks to Russia, Lewis said. The threshold for a military response is either massive economic harm or potential loss of life, he said.
When the U.S. government tied hacks on bank websites in 2012 and 2013 to Iran, the White House determined the incidents didn’t reach that level. Instead, President Barack Obama’s administration tried to shut down the attack points in Europe and elsewhere, which was a lengthy process.
“You’ll see a continued effort to strengthen the defenses of the financial sector, but there is a general reluctance to do a tit-for-tat in cyberspace,” Lewis said.
To contact the reporters on this story: Michael Riley in Washington atmichaelriley@bloomberg.net; Jordan Robertson in Washington atjrobertson40@bloomberg.net
To contact the editors responsible for this story: Winnie O’Kelley at wokelley@bloomberg.net; Pui-Wing Tam at ptam13@bloomberg.net Jesse Westbrook, Gregory Mott
Yeah, the Russians, right. Probably those “russians” located in Tel-Aviv. And the Russian thumping is reaching a crescendo. Must be killing them that Vlad won’t take the bait no matter what ploy they try.