The segment reports on a cyber‑espionage campaign known as Energetic Bear that has been infiltrating U.S. and European energy companies, including power plants, pipelines, and dams. Experts explain that the malware, likely state‑sponsored and linked to Russian actors, is used to harvest credentials through mass phishing and supply‑chain compromises, giving attackers potential control over critical infrastructure. While no sabotage has yet occurred, the threat is compared to the 2003 Northeast blackout. Robert Siciliano, an identity‑theft specialist with Hotspot Shield, describes the sophistication of the operation, the difficulty of detection due to constantly evolving code, and the broader risk to individual users. He outlines mitigation measures such as employee education, up‑to‑date antivirus/anti‑phishing tools, firewalls, VPN usage, and system redundancy. The discussion also touches on geopolitical implications, suggesting that state‑backed hacking may aim to undermine U.S. confidence and that remote access conveniences create exploitable entry points.
Chapters
Russian hackers are ratcheting up attacks on U.S. and European energy companies, and concerns are growing these hackers could be Russian government spies. They're using a type of software called Energetic Bear to try to monitor and disrupt power supplies. Roxana Sabiri has more.
There's some of America's most vulnerable sites— power plants, pipelines, dams— all controlled by computers. Many victims of a hacker group called Energetic Bear.
All we're seeing in their current motivation is still a bit of espionage because all they're doing is trying to obtain the credentials. But our worry, of course, is access to these systems gives them full control over these systems.
The fear is something like this: the blackout of 2003 when millions of people in the Northeast went without power for 2 days.
You know, some of these organizations would be considered critical infrastructure, um, in control of things like power grid or oil pipelines, wind generation facilities, and things like that, and they've gained enough access to conduct such an attack.
So far, the hackers haven't done anything more than look around. They started by infecting companies that provide software to energy firms.
The hope is, is by disclosing, uh, this campaign, they will be unable to conduct some sort of sabotage operation.
But investigators don't know much else about the group. They're believed to have been active since at least 2011. There are clues they're from Russia or Eastern Europe, and the malware they used is believed to be state sponsored, pointing to espionage. The malware is similar to Stuxnet, which the U.S. and Israel are believed to have created to sabotage Iran's nuclear facilities 7 years ago. But experts warn now that the hackers with Energetic Bear have been discovered, they'll adapt.
The problem is, is that by now the attackers are almost certainly using some modified version of their software that isn't being detected. And so it's a constantly reactive type of game.
A cybersecurity expert told me there's another reason Energetic Bear seems to be linked to a government. He said hackers working on their own don't usually work a regular daytime schedule like the ones behind this malware. And David, the antivirus firm Symantec told me it's reached out to all the companies that were infected. It's told them how to get rid of the malware.
Roxana Saberi, thank you. Robert Siciliano is an identity theft specialist with the online security company Hotspot Shield. He joins us from San Diego. And Robert, how sophisticated is this particular operation?
Well, this is your top of the food chain malware, and they're using it— they're compromising these networks essentially by sending mass amounts of phishing emails that the users or the employees of these organizations then click on the links and they ultimately infect their devices and/or, for example, they might— the employees might visit the menu online of a local Chinese restaurant, and that menu you or that website might be infected, and that also can infect their devices as well.
Given the complexity, does this then extend beyond just corporations? Are a lot of individuals at risk here?
So, you know, the conveniences of the web today put everyone at risk. The fact that you can simply click a link in the body of an email and infect your device and then infect your corporation means that we're all at significant risk. And so users must, you know, update their antivirus, anti-spyware, anti-phishing a firewall and use a VPN when connecting to wireless networks.
Do you buy the argument that this is Russia, these are Russian spies who are carrying this out?
Well, it's very possible. You know, due to the research that's been done to this point, they're able to look at the virus itself, some of the coding, and the researchers can see some similarities to other viruses or code that's been released in the past and be able to link that fingerprint to Russian coders or Russian hackers.
One of my favorite producers here, our show Our video producer Justin is very concerned about the companies and what they are doing to ward off against this. So what are they doing?
So the education of the employees themselves to know what to look for, what to click, what not to click especially, and then putting systems in place to make sure that the redundancy, that when you click a link that there are systems that will prevent that virus, let's say, that might be downloaded from infecting that network and shutting down your defenses.
Is there something about politics here, geopolitics, political politics, that it's not just about shutting down companies or energy grids, but this, in the case of Russia or China if they're involved, is about making the United States just look bad.
So the fact that, um, it's possible that, uh, it's state-sponsored hacking, uh, makes that very true, uh, that, uh, you know, if in fact they are funding these operations, that's one thing, or simply looking the other way is another. But either way, you know, um, states or countries are hacking the U.S., uh, on a minute-by-minute on a regular basis.
And originally these systems were, were built, and the reason they're vulnerable, so I understand this, is because you want technicians to be able to have remote access to fix problems, whether it's an energy blackout or power grid problem. And it's the hackers who have been able to figure out where those entry points are.
Yeah, this is all about the conveniences of technology. So the technician who might get a call that there's been a problem with a control at the utility might just log in through his home PC to be able to access remotely that system. Opposed to, say, getting in his van and driving, you know, 100 miles or so, that convenience makes that system vulnerable. So it's— and that's with any web-based technology today.
Robert Siciliano, identity theft expert with Hotspot Shield. Robert, thanks for joining us.
