U.S. Energy Lab Hit by Phishing Attack

According to an Oak Ridge National Laboratory spokeswoman, a "very sophisticated" piece of malware apparently designed to steal technical information from the Energy Department lab's network caused laboratory officials to shut down its e-mail and Internet access last week.

E-mail service was re-established on the evening of April 19, but Internet access remains down, although the lab's public facing website at remains in operation.

"This particular malware is set up to collect technical information and send it out of the lab," said Barbara Penland, the lab's deputy director of communications. "That's the reason we took the aggressive action of cutting off external access. We have been operating normally internally."

Penland said the lab hopes to have Internet access restored by the end of the week. In the meantime, the malware is being isolated and removed. The source of the malicious code and the would-be recipient of stolen data remain unknown. "That's one of the things we are investigating," she said.

Oak Ridge is managed for the Energy Department by the University of Tennessee and Battelle LLC, and conducts basic and applied research in clean energy and other areas. It also is home to Jaguar, a recently upgraded Cray XT5-based supercomputer rated one of the fastest in the world.

Penland said the lab was the target of a phishing attack that began April 7.

"We received over 500 phishing e-mails that were specifically targeted to the lab and appeared to be from the benefits department," she said. The e-mail messages contained a "more information" link, which several people clicked. "One computer was set up in a way that gave access to our network."

The attack began one day after the Homeland Security Department's US-CERT issued an advisory warning against targeted phishing attacks, and Penland confirmed that a number of other Energy Department labs and agencies had been targeted by similar attacks.

Harry Sverdlove, CTO of security company Bit9, said the Oak Ridge attack is similar to others being seen by his company against government and private-sector targets.

"This is no doubt a large and coordinated effort," he said. "It's part of a pattern we are seeing more and more. It is the most common form of attack" for targeted threats. "Why bother going around defenses when you can walk in the front door?"

Little is known so far about the malware that infected the network.

"They are calling it an advanced persistent threat, which is the nom de jure for any attack that is not stopped by traditional defenses," Sverdlove said.

About the Author

William Jackson is the senior writer for Government Computer News (


  • Windows 10 Mobile To Fall Out of Support in December

    Microsoft will end support for the Windows 10 Mobile operating system on Dec. 10, 2019, according to an announcement.

  • Get More Out of Your Outlook Inbox with TakeNote

    Brien comes across a handy, but imperfect, feature in Outlook that lets you annotate specific e-mails. Its provenance is something of a mystery, though.

  • Microsoft Resumes Rerelease of Windows 10 Version 1809

    Microsoft on Wednesday once more resumed its general rollout of the Windows 10 version 1809 upgrade, also known as the "October 2018 Update."

  • Microsoft Ups Its Windows 10 App Compatibility Assurances

    Microsoft gave assurances this week that organizations adopting Windows 10 likely won't face application compatibility issues.

comments powered by Disqus
Most   Popular

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.