US says it secretly removed malware worldwide, preempting Russian cyberattacks

WASHINGTON (NYTIMES) - The United States said on Wednesday (April 6) that it had secretly removed malware from computer networks around the world in recent weeks, a step to preempt Russian cyberattacks and send a message to President Vladimir Putin of Russia.

The move, made public by Attorney-General Merrick Garland, comes as US officials warn that Russia could try to strike American critical infrastructure - including financial firms, pipelines and the electric grid - in response to the crushing sanctions that the United States has imposed on Moscow over the war in Ukraine.

The malware enabled the Russians to create "botnets" - networks of private computers that are infected with malicious software and controlled by the GRU, the intelligence arm of the Russian military.

But it is unclear what the malware was intended to do, since it could be used for everything from surveillance to destructive attacks.

A US official said Wednesday that the United States did not want to wait to find out. Armed with secret court orders in the United States and the help of governments around the world, the Justice Department and the FBI disconnected the networks from the GRU's own controllers.

"Fortunately, we were able to disrupt this botnet before it could be used," Mr Garland said.

The court orders allowed the FBI to go into domestic corporate networks and remove the malware, sometimes without the company's knowledge.

Even as the United States works to prevent Russian attacks, some US officials fear Mr Putin may be biding his time in launching a major cyber-operation that could strike a blow at the American economy.

Until now, US officials say, the primary Russian cyber-actions have been directed at Ukraine - including "wiper" malware designed to cripple Ukrainian government offices and an attack on a European satellite system called Viasat.

The details of the satellite attack, one of the first of its kind, are of particular concern to the Pentagon and US intelligence agencies, which fear it may have exposed vulnerabilities in critical communications systems that the Russians and others could exploit.

The Biden administration has instructed critical infrastructure companies in the United States to prepare to fend off Russian cyberattacks, and intelligence officials in Britain have echoed those warnings.

And while Russian hackers have sometimes preferred to quietly infiltrate networks and gather information, researchers said that recent malware activity in Ukraine demonstrated Russia's increasing willingness to cause digital damage.

"They are engaged in a cyberwar there that is pretty intense, but it is targeted," said Mr Tom Burt, a Microsoft executive who oversees the company's efforts to counter major cyberattacks and shut down an attack in Ukraine during the opening of the war.

Security experts suspect that Russia may be responsible for other cyberattacks that have occurred since the war began, including on Ukrainian communications services, although investigations into some of those attacks are ongoing.

"Russia was interested in cutting off communication between armed forces, between our troops, and that was partially successful in the very beginning of the war," said Mr Victor Zhora, a top official at Ukraine's cybersecurity agency, the State Service of Special Communications and Information Protection.

Ukrainian officials said Russia had also been behind attempts to spread disinformation about a surrender.

In the United States, officials fear similar cyberattacks could hit critical infrastructure companies. Some executives said they hoped the federal government would offer funding for cybersecurity.

"I am perfectly well aware that if Russia as a nation-state decided it wanted to attack the national infrastructure of the US, including what I'm responsible for, I don't have much chance of stopping them," said Mr Peter Fletcher, the information security officer for the San Jose Water Co, which is part of a group that manages water services in several states.

"The entire Russian nation-state versus Peter? I'm going to lose."