CybersecurityThe Sunburst Hack Was Massive and Devastating – 5 Observations from a Cybersecurity Expert

By Paulo Shakarian

Published 4 January 2021

So much remains unknown about what is now being called the Sunburst hack, the cyberattack against U.S. government agencies and corporations. U.S. officials widely believe that Russian state-sponsored hackers are responsible. The attack gave the perpetrators access to numerous key American business and government organizations. The immediate effects will be difficult to judge, and a complete accounting of the damage is unlikely. However, the nature of the affected organizations alone makes it clear that this is perhaps the most consequential cyberattack against the U.S. to date.

So much remains unknown about what is now being called the Sunburst hack, the cyberattack against U.S. government agencies and corporations. U.S. officials widely believe that Russian state-sponsored hackers are responsible.

The attack gave the perpetrators access to numerous key American business and government organizations. The immediate effects will be difficult to judge, and a complete accounting of the damage is unlikely. However, the nature of the affected organizations alone makes it clear that this is perhaps the most consequential cyberattack against the U.S. to date.

An act of cyberwar is usually not like a bomb, which causes immediate, well-understood damage. Rather, it is more like a cancer – it’s slow to detect, difficult to eradicate, and it causes ongoing and significant damage over a long period of time. Here are five points that cybersecurity experts – the oncologists in the cancer analogy – can make with what’s known so far.

1. The Victims Were Tough Nuts to Crack
From top-tier cybersecurity firm FireEye to the U.S. Treasury, Microsoft, Intel and many other organizations, the victims of the attack are for the most part firms with comprehensive cybersecurity practices. The list of organizations that use the compromised software includes firms like MasterCard, Lockheed Martin and PricewaterhouseCoopers. SolarWinds estimates about 18,000 firms were affected.

As CEO of cybersecurity firm Cyber Reconnaissance Inc. and an associate professor of computer science at Arizona State University, I have met security professionals from many of the targeted organizations. Many of the organizations have world-class cybersecurity teams. These are some of the hardest targets to hit in corporate America. The victims of Sunburst were specifically targeted, likely with a primary focus on intelligence gathering.

2. This Was Almost Certainly the Work of a Nation – Not Criminals
Criminal hackers focus on near-term financial gain. They use techniques like ransomware to extort money from their victims, steal financial information, and harvest computing resources for activities like sending spam emails or mining for cryptocurrency.

Criminal hackers exploit well-known security vulnerabilities that, had the victims been more thorough in their security, could have been prevented. The hackers typically target organizations with weaker security, like health care systems, universities and municipal governments. University networks are notoriously decentralized, difficult to secure, and often underfund cybersecurity. Medical systems tend to use specialty medical devices that run older, vulnerable software that is difficult to upgrade.