Biden has ordered a probe into the latest ransomware attack by Reuters

By Trevor Hunnicutt

CENTRAL LAKE, Mich. (Reuters) -President Joe Biden said on Saturday that he had led U.S. intelligence agencies to investigate the fact that hundreds of U.S. companies were behind a sophisticated ransomware attack and suspected Russian gangs were involved.

Security company Huntress Labs said Friday that it believed the Russian-affiliated REvil rescue team gang was to blame for the latest outbreak of ransomware. Last month, the FBI accused the same group of stopping the meat packer JBS SA (OTC :).

During his visit to Michigan to promote the grafting program in Biden, he was asked about the hack as he was buying cakes at the cherry orchard market.

“We don’t know for sure who is behind the attack,” Biden said. “The initial thought was that it was not the Russian government but we are still not sure,” he said.

Biden said he has directed U.S. intelligence agencies to investigate, and the United States will respond if it determines that Russia is guilty.

At a summit in Geneva on June 16, Biden called on Russian President Vladimir Putin to crack down on cyber hackers leaving Russia, and warned them of the consequences if cyber-rescue attacks escalate.

Biden said he would receive brief information about the latest attack on Sunday.

“If Russia’s knowledge and / or consequence, then I told him we would respond to Putin,” Biden said, citing what he told Putin in Geneva.

The hackers who attacked him on Friday hijacked the technology management software of a Miami provider named Kaseya. They changed the Kaseya tool called VSA, which is used by companies that manage technology in small businesses. They then encrypted the files of the clients of these providers at the same time.

Huntress said she was monitoring eight service managers who were used to infect about 200 customers.

Kaseya said on his website on Friday that he was investigating a “potential attack” by the VSA, which IT professionals use to manage servers, desktops, network devices and printers.

“It’s a colossal and destructive attack on the supply chain,” Huntress security chief researcher John Hammond said in an email, citing the increasingly high-profile hacker technique of hijacking software for hundreds or thousands of users at once.

In a statement on Friday, the U.S. Cybersecurity and Infrastructure Security Agency said it was “taking steps to understand and deal with the latest supply chain ransomware attack” against Kaseya’s VSA product.

Supply chain attacks have reached the top of the cybersecurity agenda for hackers accused of the United States acting under a Russian government order and manipulating a network monitoring tool built by Texas-based software company SolarWinds.

On Thursday, U.S. and British authorities said Russian spies accused of interfering in the 2016 U.S. presidential election had committed virtual private network (VPN) abuses against hundreds of organizations around the world over the past two years.

On Friday, Russia’s embassy in Washington denied the charge.