Hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury Department and an agency that decides internet and telecommunications policy, according to people familiar with the matter.

There is concern within the U.S. intelligence community that the hackers who targeted Treasury and the Commerce Department's National Telecommunications and Information Administration used a similar tool to break into other government agencies, according to four people briefed on the matter. The people did not say which other agencies.

Three of the people familiar with the investigation said Russia is currently believed to be behind the attack.

Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.

Kremlin spokesman Dmitry Peskov dismissed the allegations.

"Once again, I can reject these accusations and once again I want to remind you that it was President (Vladimir) Putin who proposed that the American side agree and conclude agreements (with Russia) on cybersecurity," said Peskov, saying Washington had not responded to the offer.

“As for the rest, if there have been attacks for many months, and the Americans could not do anything about it, it is probably not worth immediately groundlessly blaming the Russians. We didn't have anything to do with it."

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

The breach presents a major challenge to the incoming administration of President-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for. It is not uncommon for large scale cyber investigations to take months or years to complete.

"This is a much bigger story than one single agency," said one of the people familiar with the matter. "This is a huge cyber espionage campaign targeting the U.S. government and its interests."

Hackers broke into the NTIA's office software, Microsoft's Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.

A Microsoft spokesperson did not immediately respond to a request for comment. Neither did a spokesman for the Treasury Department.

The hackers are "highly sophisticated" and have been able to trick the Microsoft platform's authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

"This is a nation-state," said a different person briefed on the matter.

The full scope of the breach is unclear. The investigation is still its early stages and involves a range of federal agencies, including the FBI, according to three of the people familiar with the matter.

A spokesperson for the Cybersecurity and Infrastructure Security Agency said they have been "working closely with our agency partners regarding recently discovered activity on government networks. CISA is providing technical assistance to affected entities as they work to identify and mitigate any potential compromises."

The FBI and U.S. National Security Agency did not immediately respond to a request for comment.

There is some indication that the email compromise at NTIA dates back to this summer, although it was only recently discovered, according to a senior U.S. official.

First Published:Dec 14, 2020 6:24 PM IST