The Cybersecurity and Infrastructure Security Agency said in its most detailed comments yet that the intrusion had compromised federal agencies as well as critical infrastructure in a sophisticated attack that was hard to detect and will be difficult to undo
This threat actor has demonstrated sophistication and complex tradecraft in these intrusions, the agency said in its unusual alert. CISA expects that removing the threat actor from compromised environments will be highly complex and challenging.

The U.S. National Security Agency issued a rare “cybersecurity advisory” Thursday detailing how certain Microsoft Azure cloud services may have been compromised by hackers and directing users to lock down their systems.

“Like other SolarWinds customers, we have been actively looking for indicators of this actor and can confirm that we detected malicious Solar Winds binaries in our environment, which we isolated and removed,” a Microsoft spokesperson said, adding that the company had found “no indications that our systems were used to attack others.”

The attack on Department of Energy has affirmed that the hackers were able to access the networks of the US national security enterprise.

The hackers are believed to have gained access to the federal agencies’ networks by compromising the software company SolarWinds, which sells IT management products to hundreds of governments and private-sector clients, POLITICO opined.