United States Commission on International Religious Freedom (USCIRF)

History

2021: Hacker Attack

In mid-December 2021, hackers gained access to the internal network of one of the federal government agencies in the United States, the antivirus company Avast said. According to The Record, the target of the attack was the US Commission on International Religious Freedom (USCIRF).

According to information on the Commission's website, USCIRF's tasks include monitoring the observance of the right to freedom of religion and belief abroad, as well as developing policy recommendations for the president, secretary of state and the US Congress. The Agency plays a primary role in shaping state policy on human rights violations and possible sanctions that the United States can apply to unscrupulous countries, it is likely that documents have access to reports on current violations around the world.

US federal agency USCIRF hacked as a result of which hackers gained full access to systems

However, despite the confidential nature of the data being processed, Avast said in its report on December 16, 2021 that the agency did not respond to a report of a security violation of its internal network. Avast information security researchers said they found traces of two malicious files on the network that actually gave attackers complete control over internal systems.

Based on our analysis of these files, we consider it reasonable to conclude that the attackers were able to intercept and possibly transfer all traffic to the local network of this organization. This may include information exchanged between other U.S. government agencies and other international governmental and non-governmental organizations (NGOs) concerned with international rights. We also have signs that attackers could run code at their discretion in the context of the operating system on infected systems, which gave them complete control, "said Avast malware researcher Yan Rubin.

However, Avast noted that it considers the attack a classic operation of the type - an advanced constant threat, a term used in the cybersecurity industry to describe state-sponsored groups. The researchers said they noted some subtle links to Operation Red Signature, a report published in 2018 by Trend Micro, but the evidence is not enough to make official attribution without broader consideration of the current attack.^[1]

Notes