U.S. Energy Lab Hit by Phishing Attack

According to an Oak Ridge National Laboratory spokeswoman, a "very sophisticated" piece of malware apparently designed to steal technical information from the Energy Department lab's network caused laboratory officials to shut down its e-mail and Internet access last week.

E-mail service was re-established on the evening of April 19, but Internet access remains down, although the lab's public facing website at remains in operation.

"This particular malware is set up to collect technical information and send it out of the lab," said Barbara Penland, the lab's deputy director of communications. "That's the reason we took the aggressive action of cutting off external access. We have been operating normally internally."

Penland said the lab hopes to have Internet access restored by the end of the week. In the meantime, the malware is being isolated and removed. The source of the malicious code and the would-be recipient of stolen data remain unknown. "That's one of the things we are investigating," she said.

Oak Ridge is managed for the Energy Department by the University of Tennessee and Battelle LLC, and conducts basic and applied research in clean energy and other areas. It also is home to Jaguar, a recently upgraded Cray XT5-based supercomputer rated one of the fastest in the world.

Penland said the lab was the target of a phishing attack that began April 7.

"We received over 500 phishing e-mails that were specifically targeted to the lab and appeared to be from the benefits department," she said. The e-mail messages contained a "more information" link, which several people clicked. "One computer was set up in a way that gave access to our network."

The attack began one day after the Homeland Security Department's US-CERT issued an advisory warning against targeted phishing attacks, and Penland confirmed that a number of other Energy Department labs and agencies had been targeted by similar attacks.

Harry Sverdlove, CTO of security company Bit9, said the Oak Ridge attack is similar to others being seen by his company against government and private-sector targets.

"This is no doubt a large and coordinated effort," he said. "It's part of a pattern we are seeing more and more. It is the most common form of attack" for targeted threats. "Why bother going around defenses when you can walk in the front door?"

Little is known so far about the malware that infected the network.

"They are calling it an advanced persistent threat, which is the nom de jure for any attack that is not stopped by traditional defenses," Sverdlove said.

About the Author

William Jackson is the senior writer for Government Computer News (


  • Basic Authentication Extended to 2H 2021 for Exchange Online Users

    Microsoft is now planning to disable Basic Authentication use with its Exchange Online service sometime in the "second half of 2021," according to a Friday announcement.

  • Microsoft Offers Endpoint Configuration Manager Advice for Keeping Remote Clients Patched

    Microsoft this week offered advice for organizations using Microsoft Endpoint Configuration Manager with remote Windows systems that need to get patched, and it also announced Update 2002.

  • Azure Edge Zones Hit Preview

    Azure Edge Zones, a new edge computing technology from Microsoft designed to enable new scenarios for developers and partners, emerged as a preview release this week.

  • Microsoft Shifts 2020 Events To Be Online Only

    Microsoft is shifting its big events this year to be online only, including Ignite 2020.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.