U.S. Energy Lab Hit by Phishing Attack

According to an Oak Ridge National Laboratory spokeswoman, a "very sophisticated" piece of malware apparently designed to steal technical information from the Energy Department lab's network caused laboratory officials to shut down its e-mail and Internet access last week.

E-mail service was re-established on the evening of April 19, but Internet access remains down, although the lab's public facing website at remains in operation.

"This particular malware is set up to collect technical information and send it out of the lab," said Barbara Penland, the lab's deputy director of communications. "That's the reason we took the aggressive action of cutting off external access. We have been operating normally internally."

Penland said the lab hopes to have Internet access restored by the end of the week. In the meantime, the malware is being isolated and removed. The source of the malicious code and the would-be recipient of stolen data remain unknown. "That's one of the things we are investigating," she said.

Oak Ridge is managed for the Energy Department by the University of Tennessee and Battelle LLC, and conducts basic and applied research in clean energy and other areas. It also is home to Jaguar, a recently upgraded Cray XT5-based supercomputer rated one of the fastest in the world.

Penland said the lab was the target of a phishing attack that began April 7.

"We received over 500 phishing e-mails that were specifically targeted to the lab and appeared to be from the benefits department," she said. The e-mail messages contained a "more information" link, which several people clicked. "One computer was set up in a way that gave access to our network."

The attack began one day after the Homeland Security Department's US-CERT issued an advisory warning against targeted phishing attacks, and Penland confirmed that a number of other Energy Department labs and agencies had been targeted by similar attacks.

Harry Sverdlove, CTO of security company Bit9, said the Oak Ridge attack is similar to others being seen by his company against government and private-sector targets.

"This is no doubt a large and coordinated effort," he said. "It's part of a pattern we are seeing more and more. It is the most common form of attack" for targeted threats. "Why bother going around defenses when you can walk in the front door?"

Little is known so far about the malware that infected the network.

"They are calling it an advanced persistent threat, which is the nom de jure for any attack that is not stopped by traditional defenses," Sverdlove said.

About the Author

William Jackson is the senior writer for Government Computer News (


  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

  • Microsoft Open License To End Next Year for Government and Education Groups

    Microsoft's "Open License program" will end on Jan. 1, 2022, and not just for commercial customers, but also for government, education and nonprofit organizations.

comments powered by Disqus