HHS TLP White: State Sponsored Russian Cyber Actors Targeted Energy Sector From 2011 to 2018 March 25, 2022

Executive Summary

On March 24, 2022, CISA, the Federal Bureau of Investigation, and the Department of Energy released a joint Cybersecurity Advisory (CSA) detailing campaigns conducted by state-sponsored Russian cyber actors from 2011 to 2018 that targeted U.S. and international Energy Sector organizations. The CSA highlights historical tactics, techniques, and procedures (TTPs) as well as mitigations Energy Sector organizations can take now to protect their networks. On March 24, 2022, the U.S. Department of Justice unsealed indictments of three Russian Federal Security Service (FSB) officers and a Russian Federation Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) employee for their involvement in the following intrusion campaigns against U.S. and international oil refineries, nuclear facilities, and energy companies. This CSA provides the TTPs used by indicted FSB and TsNIIKhM actors in cyber operations against the global Energy Sector.

View the detailed report below.