U.S. Cyber Command is reportedly going on offense against Russia’s power grid by placing “potentially crippling malware” in its systems, The New York Times reported Saturday.
The cyber incursions, authorized to Cyber Command under new authorities that do not require presidential approval, have gotten more “aggressive” and seem to be a warning that the U.S. can respond to Moscow’s past cyberattacks, such as the 2016 incursion into the Democratic National Committee and its attack on Ukraine’s power grid.
“It has gotten far, far more aggressive over the past year,” one senior intelligence official told The Times. “We are doing things at a scale that we never contemplated a few years ago.”
The Times writes:
Both General Nakasone and Mr. Bolton, through spokesmen, declined to answer questions about the incursions into Russia’s grid. Officials at the National Security Council also declined to comment but said they had no national security concerns about the details of The New York Times’s reporting about the targeting of the Russian grid, perhaps an indication that some of the intrusions were intended to be noticed by the Russians.
Given the nature of Cyber Command’s work is highly classified, it is not known what the malware being used against Russia is capable of.
However, some insight may be gleaned from a previously-reported program called Nitro Zeus — the code name for an operation that allowed the U.S. to shut down much of Iran’s infrastructure ahead of a full-scale war through cyber means.
The plan for Nitro Zeus went much further than Stuxnet — the first known cyber weapon to cause physical damage — allowing the National Security Agency to attack Iran’s command-and-control systems, so it would not be able to communicate. It could hack in and disable air defenses, so US or Israeli planes would not be shot down. And systems such as the power grid, communications, and financial systems were all infected or backdoored, in case of war.
“This was an enormous, and enormously complex, program,” one participant in the program told The New York Times. “Before it was developed, the US had never assembled a combined cyber and kinetic attack plan on this scale.”