The FBI confirmed on Monday that the DarkSide ransomware gang, which is based in Russia, was responsible for the compromise of the Colonial Pipeline networks. So far, though, the U.S. government has not reported any indication that the gang acted at the behest or on behalf of the Russian government.
“Our intelligence community is looking for any ties to any nation-state actors, and if we find that further information, we’ll look into it further,” Anne Neuberger, the deputy national security adviser for cyber and emerging technology, told reporters at the White House press briefing on Monday.
Wholesale gasoline prices, which had initially jumped after the attack, gave back the gains and were trading nearly flat with prices seen last week before the attack was made public.
Colonial, which has engaged the services of leading cybersecurity firm FireEye, has not requested the government’s help in responding to the digital intrusion, Neuberger said. Asked on Monday whether that limited the government’s visibility into the threat, Neuberger said that the Biden administration was “happy that they are confident in their ability to remediate the incident.”
The Colonial hack has revitalized the debate about whether ransomware victims should pay to regain access to their data and whether the government should ban such ransom payments. The FBI and other agencies typically discourage victims from paying a ransom but also acknowledge the difficult position in which this would put them.
Neuberger declined to publicly offer advice to Colonial one way or the other during Monday’s briefing.
“We recognize that victims of cyberattacks often face a very difficult situation, and they have to balance the cost-benefit when they have no choice with regard to paying a ransom,” Neuberger said. “Colonial is a private company, and we’ll defer any information regarding their decision on paying a ransom to them.”
At Monday’s briefing, White House Homeland Security adviser Elizabeth Sherwood-Randall said the Department of Energy was talking to state and local agencies to assess fuel supplies and other impacts from the shutdown.
“There are no supply disruptions and the [DOE] is doing the analysis right now about potential supply disruption,” Sherwood-Randall said. “We’re working with other agencies to consider how, if necessary, we can move supplies to a place where it might be needed if it turns out that there is a shortfall.”
The Energy Department has also convened representatives of the oil and natural gas and electric industries to share details about ransomware attacks and recommend measures to mitigate further incidents, Sherwood-Randall said.
