A ransomware attack on one of the world’s largest meat processors has become yet another cyber-incident affecting daily life for Americans.
And just like the attack on one of the country’s largest fuel pipelines just weeks ago, the breach appears to involve Russia.
“This is an issue that we have discussed with the Russian government, the specific issue, and we’ve discussed it in the past and delivered the message that responsible states do not harbor ransomware criminals,” says Jen Psaki, White House Press Secretary.
Security experts say Moscow protects cybercriminals from extradition requests, and most major penalties.
"So what's Russia's relationship like with these ransomware hackers?" Newsy reporter Sasha Ingber asked Peter Warmka, former CIA intelligence officer and founder of the Counterintelligence Institute.
"In many cases, there are former Russian intelligence officers who become involved in criminal activity and participate in these criminal groups," Warmka says. "There's been individuals who have been identified in the past, that are basically identified by the U.S. government."
Russia’s security services have also historically recruited criminal hackers.
"I think this relationship between the Russian security services and criminal hackers is still going on," Andrei Soldatov, Russian security services expert, said.
A Russia-linked group called REvil is behind the attacks on the massive meat processor, JBS. And many cybersecurity experts say those hackers have connections to DarkSide, the group that targeted Colonial Pipeline in May.
"So what would incentivize the Russians to hand over these cyber criminals?" Ingber asked.
"It would really take something that would garner a political benefit at a very high level. Until the Russian government can receive something in exchange, they're not likely to cooperate at all," says Warmka.
The White House says the FBI is investigating, with the Department of Homeland Security’s cybersecurity branch providing technical support.
President Biden has also launched a “rapid strategic review.” That includes building an international coalition to hold countries who harbor cyber criminals accountable.
“We’re also going to pursue a measure to disrupt their ability to operate. And our Justice Department has launched a new task force dedicated to prosecuting ransomware hackers to the full extent of the law,” the president said in May.
Meanwhile, the disrupted food company says it’s taking daily calls with government officials, sparing no resources ... and that most of its meat, poultry, and prepared foods plants, which were shut down after the hack, would be back in operation again soon.
