Hillicon Valley: Russian hackers return to spotlight with vaccine research attack | Twitter says 130 accounts targeted in this week’s cyberattack | Four fired, dozens suspended in CBP probe into racist, sexist Facebook groups

by Maggie Miller and Chris Mills Rodrigo - 07/17/20 6:30 PM ET

Welcome to Hillicon Valley, The Hill’s newsletter detailing all you need to know about the tech and cyber news from Capitol Hill to Silicon Valley. If you don’t already, be sure to sign up for our newsletter with this LINK.

Welcome! Follow our cyber reporter, Maggie Miller (@magmill95), and tech reporter, Chris Mills Rodrigo (@chrisismills), for more coverage.

THE NEVER-ENDING THREAT: Russia is facing renewed scrutiny for its cyber espionage efforts after the U.S., Great Britain and Canada alleged Thursday that a Kremlin-linked hacking group is attempting to steal research related to coronavirus vaccine developments and testing.

The hacking group known as APT29, or “Cozy Bear,” is largely believed to operate as part of Russia’s security services, and the three countries say that it is carrying out a persistent and ongoing cyber campaign to steal intellectual property about a possible coronavirus vaccine.

According to cybersecurity organization CrowdStrike, the group was also one of two Russian cells that hacked into Democratic National Committee networks between 2015 and 2016 in the lead-up to the presidential election.

The United Kingdom’s National Cyber Security Centre (NCSC) first revealed the findings in a report posted online Thursday that warned APT29 has targeted research and development organizations in the U.K., U.S. and Canada using a variety of tools, including spear-phishing techniques and custom malware to help in their hacking attempts.

Top intelligence lawmakers including Sen. Mark Warner (D-Va.), the vice chairman of the Senate Intelligence Committee, are calling for more powerful responses to Russian’s virtual aggressions.

“It should be clear by now that Russia’s hacking efforts didn’t stop after the 2016 election,” Warner said in a statement to The Hill. “Moving forward, the United States and the western world need to be prepared for increasingly aggressive cyber-attacks from Russian actors.”

House Intelligence Committee Chairman Adam Schiff (D-Calif.) said the hacking efforts were a sign of desperation from Russian President Vladimir Putin.

“With an economy one-tenth the size of ours and a scientific research and development capacity that has withered in the decades since the fall of the Soviet Union, it is not surprising that Vladimir Putin reportedly would resort to theft as a way of trying to secure every possible advantage as Russia and other countries vie with the United States and others in the search for a vaccine,” Schiff said in a statement.

TWITTER GIVES AN UPDATE: Twitter said Thursday night that 130 accounts were targeted in a hacking incident this week that constituted one of the biggest security breaches suffered by the social media platform.

Among those whose accounts were hacked were former President Obama, former Vice President Joe Biden and Tesla CEO Elon Musk.

“Based on what we know right now, we believe approximately 130 accounts were targeted by the attackers in some way as part of the incident,” the company tweeted. “For a small subset of these accounts, the attackers were able to gain control of the accounts and then send Tweets from those accounts.”

The incident began Tuesday night, when several high-profile verified Twitter accounts began tweeting out posts asking users to send them money through bitcoin. Twitter later said hackers targeted employees with access to internal systems and tools in what the company described as a successful “coordinated social engineering attack.”

While the posts were quickly taken down by Twitter and verified accounts were partially locked down for hours to ensure no other accounts posted the message, the individuals responsible raised the equivalent of over $115,000.

Accounts compromised also included those of Amazon CEO Jeff Bezos and Microsoft co-founder Bill Gates. The accounts of major companies including Uber and Apple were also targeted.

Twitter said Thursday night that it was working with the owners of the targeted accounts and that the company was still assessing whether “non-public data” was compromised during the hacking incident. Experts have raised concerns that sensitive direct messages tied to the accounts could have been accessed and that other data may have been stolen.

CBP EMPLOYEES FIRED OVER RACIST POSTS: U.S. Customs and Border Protection (CBP) has fired four employees and suspended dozens of others as part of an investigation into their participation in Facebook groups full of racist and sexist content.

A spokesperson confirmed to The Hill on Friday that the agency investigated 138 cases tied to the Facebook groups exposed more than a year ago by ProPublica.

“Of those, the agency found that 63 allegations were unsubstantiated, 4 employees were removed from service, 38 employees were suspended without pay, and the remaining were disciplined with reprimands or counseling,” the spokesperson said in a statement.

The Los Angeles Times first reported on the firings; 6 cases remained open as of Wednesday.

The CBP announced last year that 70 current or former employees were under internal investigation for posts in the groups that included derogatory comments toward immigrants and lawmakers.

Most were involved in a group called “I’m 10-15,” a reference to the code for “aliens in custody.”

In that group, which had upwards of 9,000 members, current and former employees joked about dead migrants and an edited image of a smiling President Trump forcing Rep. Alexandria Ocasio-Cortez’s (D-N.Y.) head toward his crotch.

In response to a post about a 16-year-old Guatemalan migrant who died last May at a Border Patrol station, one member wrote, “If he dies, he dies,” while another posted an Elmo GIF that read, “Oh well.”