美国联邦调查局局长克里斯托弗·雷(Christopher Wray)周二表示，在俄罗斯与乌克兰开战后，美国联邦调查局对俄罗斯针对美国关键基础设施进行网络攻击的可能性感到“担忧”。
“我们担心它的原因不仅仅是基于我们对俄罗斯人如何运作的长期了解，而是它实际上是我们一直在一起进行的具体调查工作和监视工作的产物，”雷在底特律经济俱乐部对观众说。
“大多数网络攻击不会在一瞬间发生。有活动导致它。有扫描和研究，研究受害者，扫描漏洞和系统。正在开发进入这些系统的途径。因此，有一系列的准备工作，这就是我们所看到的，”他说。
据一位熟悉情况的消息人士称，联邦调查局已经看到五家美国能源公司的系统被扫描由CBS新闻首先报道的机构公告。美国广播公司新闻已经证实了公告的内容。
“今天，随着乌克兰持续的冲突肆虐，我们特别关注俄罗斯英特尔服务以及他们保护和支持的网络犯罪集团构成的破坏性网络威胁，”雷在准备好的讲话中说。“我们的网络人员与乌克兰人和我们的其他海外盟友，以及私营部门和我们在这里的合作伙伴密切合作。”
周一，美国总统乔·拜登敦促美国企业加强网络防御，称美国遭受网络攻击的威胁已经增加，因为俄罗斯总统弗拉基米尔·普京已经“背靠着墙”
拜登在一份声明中说:“我以前警告过俄罗斯可能会对美国进行恶意网络活动，包括作为对我们与盟友和伙伴一起给俄罗斯带来的前所未有的经济成本的回应。”“这是俄罗斯剧本的一部分。今天，我的政府基于不断发展的情报重申这些警告，即俄罗斯政府正在探索潜在网络攻击的选项。”
在周一的白宫新闻发布会上，负责网络和新兴技术的副国家安全顾问安妮·纽伯格回应了他的评论。她没有详细说明官员们到底看到了什么，但她向记者强调，政府已经加强了对网络攻击的准备。
亚历克斯·王/盖蒂图片公司
负责网络和新兴技术的副国家安全顾问.
“就在上周，联邦机构召集了100多家公司，根据这种不断发展的威胁情报，分享新的网络安全威胁信息。在这些会议中，我们分享了资源和工具，以帮助公司加强其安全性。就像来自敏感威胁情报的咨询和来自当地联邦调查局外地办事处和姐妹地区办事处的实际支持，包括他们的盾牌行动计划，”Neuberger说。
Neuberger表示，没有证据表明发生了具体的网络攻击，但“一些准备活动”促使白宫向他们认为可能受到影响的行业的公司提供分类简报，但没有详细说明包括哪些行业，尽管在简报会上几次被要求提供更多细节。
国土安全部部长亚历杭德罗·马约尔卡斯(Alejandro Mayorkas)和网络安全和基础设施安全局局长詹恩·伊斯特利(Jenn Easterly)都表示，DHS有资源打击对私营企业的网络攻击，并敦促企业保护自己。
“各种规模和各行各业的组织都应该继续加强他们的网络安全防御，”Mayorkas说。
上周，Mayorkas被问及随着乌克兰冲突的持续，勒索软件攻击的威胁。
阅读更多
他说，2021年，勒索软件攻击的数量比2020年增加了300%，勒索软件损失总额接近3亿美元。他敦促企业加强网络防御，尤其是在冲突持续的时候。
“其中一些措施非常简单易行。他周四对记者说:“修改密码、加强多重身份认证、备份一个系统，这些都是可以采取的基本步骤。”。
“到目前为止，我们一直倾向于与私营部门沟通，私营部门拥有绝大多数关键基础设施，使它们能够防止威胁成为现实，在攻击(发生)时迅速有效地做出反应，并在俄罗斯攻击和俄罗斯可能寻求通过网络渠道进行报复的真实可能性发生的同时证明自己的弹性。”
由于2021年的重大网络攻击，拜登政府收紧了对关键基础设施某些部分的网络攻击报告规定，如管道和航空公司。
行业和专家正在认真对待来自白宫的这一警告。
“虽然俄罗斯尚未发动更具侵略性或破坏性的网络攻击，破坏乌克兰或其他地方的关键基础设施或删除敏感数据，但政府的评论表明，最近的情报显示，俄罗斯网络运营商正在美国进行数字侦察或电子探测电子系统，可能导致这些类型的行动，”国家安全委员会前高级反恐主任贾韦德·阿里(Javed Ali)对美国广播公司新闻(ABC News)说。
“这些公开声明似乎从不同的情报来源和方法中提供了有关俄罗斯网络威胁和其他军事发展的线索，是拜登政府向普京施压的整体战略的一部分，并表明美国及其合作伙伴事先知道俄罗斯的意图，”他说。
关键基础设施公司正在监控这一威胁，包括田纳西流域管理局(Tennessee Valley Authority)，该公司为田纳西州及周边各州的153家当地电力公司提供电力。
“TVA持续监控不断变化的网络安全威胁，”公司发言人告诉ABC新闻。“我们采用多层安全策略，包括硬件、软件和程序控制的组合，以保护我们关键的发电、传输和业务基础设施系统。TVA的网络安全团队全天候监控整个企业，并与联邦安全机构协调，针对目标网络安全问题快速实施新的保护措施。”
FBI 'concerned' about Russian cyberattacks on critical US infrastructure: Wray
FBI Director Christopher Wray said Tuesday the FBI is "concerned' with the possibility of Russian cyberattacks against critical U.S. infrastructure in the wake of Russia's war with Ukraine.
"The reason we're concerned about it is not just based on our longstanding understanding of how the Russians operate, but it's actually the product of specific investigative work and surveillance work that we've been doing all together," Wray told an audience at the Detroit Economic Club.
"Most cyberattacks don't just happen in an instant. There's activity that leads up to it. There's scanning and researching, researching a victim, scanning for vulnerabilities and systems. There's developing access to those systems. So, there's a whole range of preparatory work, which is what we've been seeing," he said.
It comes as the FBI has seen five U.S. energy companies have their systems scanned, according to a source familiar with the situation, outlined in anagency bulletin first reported by CBS News. ABC News has confirmed the bulletin's contents.
"Today, with the ongoing conflict raging in Ukraine, we're particularly focused on the destructive cyber threat posed by the Russian intel services, and cybercriminal groups they protect and support," Wray said in prepared remarks. "We have cyber personnel working closely with the Ukrainians and our other allies abroad, and with the private sector and our partners here."
On Monday, President Joe Biden urged American businesses to shore up their cyber defenses, saying the threat of a cyberattack on the U.S. has grown now that Russian President Vladimir Putin has his "back against the wall."
"I have previously warned about the potential that Russia could conduct malicious cyber activity against the United States, including as a response to the unprecedented economic costs we've imposed on Russia alongside our allies and partners," Biden said in a statement. "It's part of Russia's playbook. Today, my Administration is reiterating those warnings based on evolving intelligence that the Russian Government is exploring options for potential cyberattacks."
Echoing his comments was the deputy national security adviser for Cyber and Emerging Technology Anne Neuburger at Monday's White House press briefing. She did not go into details about what exactly officials are seeing, but stressed to reporters the government has stepped up preparations for a cyber attack.
"Just last week, federal agencies convened in more than 100 companies to share new cybersecurity threat information, in light of this evolving threat intelligence. During those meetings, we shared resources and tools to help companies harden their security. Like advisory sourced from sensitive threat intelligence and hands on support from local FBI field offices, and sister regional offices, including their shields up program," Neuberger said.
Neuberger said there was not evidence of a specific cyberattack, but "some preparatory activity" that prompted the White House to give classified briefings to companies in sectors they thought could be impacted -- without detailing what sectors that included, despite being pressed for more specifics several times during the briefing.
Homeland Security Secretary Alejandro Mayorkas and the Cybersecurity and Infrastructure Security Agency Director Jenn Easterly both said DHS has resources to combat cyberattacks for private businesses and urged companies to protect themselves.
"Organizations of every size and across every sector should continue enhancing their cybersecurity defenses," Mayorkas said.
Last week, Mayorkas was asked about the threat of ransomware attacks as the conflict in Ukraine continues.
He said in 2021 there was a 300% increase in the number of ransomware attacks from 2020 -- with ransomware losses totally close to $300 million. He urged companies to sure up their cyber defenses, especially while the conflict continues.
"Some of those measures are so simple and accessible. changing one's password making one's password strong multi factor authentication, backing up one system, there are elementary steps that one can take," he told reporters Thursday.
"We have been leaning so far forward in communicating with the private sector, which owns the vast majority of critical infrastructure to equip them to prevent a threat from materializing, to respond swiftly and effectively to an attack should it [occur], and to prove resilient in contemporaneous with the Russian attack and the real possibility that Russia might seek to retaliate via a cyber channel."
As a result of major cyber-attacks in 2021, the Biden administration has tightened cyberattack reporting regulations for certain portions of critical infrastructure, such as pipelines and airlines.
Industry and experts are taking this warning from the White House seriously.
"While Russia has not yet launched more aggressive or destructive cyber-attacks that have impaired critical infrastructure or deleted sensitive data in Ukraine or elsewhere, the administration's comments suggest recent intelligence indicates Russian cyber operators are conducting digital reconnaissance or electronically probing electronic systems in the United States that could lead to those types of operations," Javed Ali, the former senior counterterrorism Director at the National Security Council told ABC News.
"These public statements that seem to give clues about Russian cyber threats and other military developments from different intelligence sources and methods are part of the Biden administration's overall strategy to put pressure on Putin and demonstrate that the United States and its partners have advance notice of Russia's intentions," he said.
Critical infrastructure companies are monitoring the threat, including the Tennessee Valley Authority, a company that provides electricity for 153 local power companies in Tennessee and surrounding states.
"TVA continually monitors for ever-changing threats to cybersecurity," a company spokesperson told ABC News. "We use a multi-layer security strategy, including a combination of hardware, software and procedural controls, to secure our critical generation, transmission and business infrastructure systems. TVA's cybersecurity team monitors the entire enterprise 24/7 and coordinates with federal security agencies to rapidly implement new protective measures for targeted cybersecurity issues."
