--- title: Russian Hackers Target Treasury and Commerce Departents description: Russian hackers are believed to be behind a massive breach in the federal government’s databases and other Microsoft related systems. image: https://blog.axisins.com/hubfs/Front%20of%20an%20old%20greek%20or%20roman%20style%20law%20building.jpeg --- [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) Connect with us Call us Today [(201) 847-9175](tel:2018479175) [(877) 787-5258](tel:8777875258) - - About Axis - [Our Approach](https://www.axisins.com/about-us/) - [Our Team](https://www.axisins.com/our-team/) - [Testimonials](https://www.axisins.com/testimonials/) - [Case Studies](https://www.axisins.com/case-studies/) - [News & Events](https://blog.axisins.com/tag/news-and-events) - [Careers](https://www.axisins.com/job-opportunities/) - Product Lines - [Overview](https://www.axisins.com/products/) - [On-line Quoting](https://www.axisins.com/products/on-line-quoting/) - [Surety Bonds](https://www.axisins.com/products/surety-bonds/) - [Cyber Liability/Privacy & Network Security](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Overview](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Why Cyber Liability](https://www.axisins.com/products/cyber-liability-privacy-network-security/why-cyber-liability/) - [Cyber Hotline/Resources](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) - [Claims Scenarios](https://www.axisins.com/products/cyber-liability-privacy-network-security/claims-scenarios/) - [Professional Liability Insurance (E&O)](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Overview](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Professions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/professions/) - [Insurance](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/insurance-agents-brokers/) - [Legal](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/legal/) - [Real Estate](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/real-estate-agents-brokers/) - [Technology](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/technology/) - [Healthcare/Medical](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/healthcare-medical-practice/) - [Architects & Engineers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/architects-engineers/) - [Financial Institutions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/financial-institutions/) - [Construction](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/construction/) - [Consulting](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/consulting/) - [Media](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/media/) - [Mortgage Bankers & Brokers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/mortgage-bankers-brokers/) - [Miscellaneous Services](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/miscellaneous-services/) - [Resources](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/resources/) - [Claims Scenarios](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/claims-scenarios/) - [Management Liability Insurance (D&O)](https://www.axisins.com/products/management-liability-insurance-do/) - [Overview](https://www.axisins.com/products/management-liability-insurance-do/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/management-liability-insurance-do/claims-scenarios/) - [Resources](https://www.axisins.com/products/management-liability-insurance-do/resources/) - [Employment Practices Liability Insurance](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Overview](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/employment-practices-liability-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/employment-practices-liability-insurance/resources/) - [Crime Insurance](https://www.axisins.com/products/crime-insurance/) - [Overview](https://www.axisins.com/products/crime-insurance/) - [Claims Scenarios](https://www.axisins.com/products/crime-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/crime-insurance/resources/) - [Fiduciary Liability](https://www.axisins.com/products/fiduciary-liability/) - [Overview](https://www.axisins.com/products/fiduciary-liability/) - [Claims Scenarios](https://www.axisins.com/products/fiduciary-liability/claims-scenarios/) - [Resources](https://www.axisins.com/products/fiduciary-liability/resources/) - [FAQs](https://www.axisins.com/faqs/) - Client Resources - [Make a Payment](https://axisins.epaypolicy.com/) - [Apps & Forms](https://www.axisins.com/client-resources/apps-forms/) - [Report A Claim](https://www.axisins.com/client-resources/report-a-claim/) - [Request A Certificate of Insurance](https://www.axisins.com/client-resources/request-a-certificate-of-insurance/) - [Blog](https://blog.axisins.com/) - [Contact Us](https://www.axisins.com/contact-us/) -   CALL US TODAY [(877) 787-5258](tel:8777875258) ## Keeping you up to date on trends, emerging exposures and other critical issues. [Subscribe To Our Blog](https://share.hsforms.com/18qZLml0MTSqtYWBFqQFAGA35dv4?__hstc=172306556.605fbd816f522e1de3e9428cb969d5b4.1580877711545.1580973215492.1580978435349.10&__hssc=172306556.3.1580978435349&__hsfp=1035641285) # Russian Hackers Target Treasury and Commerce Departents December 17, 2020 ![](https://blog.axisins.com/hubfs/Front%20of%20an%20old%20greek%20or%20roman%20style%20law%20building.jpeg) Drew Smith ![Front of an old greek or roman style law building](https://blog.axisins.com/hs-fs/hubfs/Front%20of%20an%20old%20greek%20or%20roman%20style%20law%20building.jpeg?width=1000&name=Front%20of%20an%20old%20greek%20or%20roman%20style%20law%20building.jpeg) Russian hackers are believed to be behind a massive breach in the federal government’s databases and other Microsoft related systems. The perpetrators believed to be behind the attacks, Cozybear, are the same ones that had breached the 2016 Democratic National Convention. The hackers used a compromised server to target SolarWinds, a software provider and then used the server to infect Microsoft updates. From March through June, these hackers used Trojan Horse malware, or malware that hides other computer viruses, to infect these important updates to allow them to gain backdoor access to these networks.[\[1\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftn1) In addition to SolarWinds, Fireeye, a cybersecurity company, was also breached and they had tools they used to test customer’s security stolen, which presumably was part of the SolarWinds hack [\[2\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftn2) Microsoft’s response was swift and decisive on the malware they dubbed Solorigate: - First, the day the attack became public Microsoft [announced](https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/)that it removed the digital certificates that the Trojaned files used. These digital certificates allowed Microsoft Windows systems to believe that those compromised files were trustworthy. In this single act, Microsoft literally overnight told all Windows systems to stop trusting those compromised files which could stop them from being used. - Second, they updated Microsoft Windows Defender, their antimalware system to detect and alert if they found the Trojaned file before isolating it - Third, they moved to sinkhole the domain the malware used to control the systems. Essentially, Microsoft went to court to pull the domain from the hackers. Once the server is under their control, they severed the hacker’s access to the domain and any domains they had control over. This tactic has been used successfully in the past, most recently against the Trickbot Malware. - Fourth, Microsoft changed Windows Defender’s default action on this malware from Alert to Quarantine. This action, which may crash a system, means that if Windows Defender finds Solorigate, it can destroy it. All these actions mean that the hackers basically have little to no direct access to the infected servers. They may still have other compromised networks, which forensics and investigators will figure out along with the damage they had caused.[\[3\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftn3) While this breach is stunning and horrifying, it shows it can happen to anyone even the federal government. Cyber breaches are no joke, and they will continue to rise as we head into the new year. Be vigilant and talk with your provider about cyber insurance options when a breach occurs.   [\[1\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftnref1) [https://www.zdnet.com/article/microsoft-fireeye-confirm-solarwinds-supply-chain-attack/](https://www.zdnet.com/article/microsoft-fireeye-confirm-solarwinds-supply-chain-attack/) [\[2\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftnref2) [https://www.zdnet.com/article/fireeye-one-of-the-worlds-largest-security-firms-discloses-security-breach/](https://www.zdnet.com/article/fireeye-one-of-the-worlds-largest-security-firms-discloses-security-breach/) [\[3\]](https://blog.axisins.com/russian-hackers-target-treasury-and-commerce-departents#_ftnref3) https://www.geekwire.com/2020/microsoft-unleashes-death-star-solarwinds-hackers-extraordinary-response-breach/ [The Need for Mortgage Broker Communication Amid COVID](https://blog.axisins.com/the-need-for-mortgage-broker-communication-amid-covid) [What Does a Hardening D&O Market Mean for Companies?](https://blog.axisins.com/what-does-a-hardening-do-market-mean-for-companies) Search ### Share this post [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/x-twitter-color.png?width=24&name=x-twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Frussian-hackers-target-treasury-and-commerce-departents%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Recent Posts ### Categories - [E&O (19)](https://blog.axisins.com/tag/eo) - [Cannabis (11)](https://blog.axisins.com/tag/cannabis) - [Company News (1)](https://blog.axisins.com/tag/company-news) ![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/art2.png) ### Connect to Our Cyber Hotline & Resources [Connect](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) Please see our [Privacy Policy](https://www.axisins.com/privacy-policy) to understand how Axis Insurance Services handles your personal information. California Residents are entitled to specific rights which can be outlined on our Notice for [California Residents](https://www.axisins.com/california-privacy-policy). You may request information regarding our privacy policy or update your preferences by contacting us directly at 201-847-9175 or by completing the Request for Information on [Privacy form](https://info.axisins.com/axis-request-for-information-on-privacy). ### Schedule a Consultation ### Stay tuned with us on social networks! [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) 795 Franklin Avenue, Suite 210 Franklin Lakes, NJ 07417 Phone: [201-847-9175](tel:2018479175) Fax: 201-847-9174 [www.axisins.com](http://www.axisins.com/) ### Quick Navigation - [Home](https://www.axisins.com/) - [About Axis](https://www.axisins.com/about-us/) - [FAQs](https://www.axisins.com/faqs/) - [Blog](https://www.axisins.com/blog/) - [Site Map](https://www.axisins.com/site-map/) - [Contact Us](https://www.axisins.com/contact-us/) - [Privacy Policy](https://www.axisins.com/privacy-policy/) - [Terms & Conditions](https://www.axisins.com/terms-conditions/) - [Accessibility Statement](https://www.axisins.com/accessibility-statement/) - [State Licenses](https://www.axisins.com/state-licenses/) Copyright ©2022 – 2024, Axis Insurance Services, LLC In California and Texas as NJ Axis Insurance Services, LLC. In Illinois as Axis Insurance Services of New Jersey, LLC. In New York as NJ Axis Insurance Agency New Jersey Corporate License #OP-9948294. California Corporate License #OD-79693. Axis Insurance Services, LLC is not affiliated with Axis Insurance Company, Axis Capital, its subsidiaries, or affiliates in any way.