A joint task force of investigative US government agencies issued a statement Tuesday saying that the massive SolarWinds hack was "likely Russian in nature."
The statement, which was also signed by the FBI, the Cybersecurity and Infrastructure Security Agency, and the National Security Agency, marked a rare unified public response to the hack.
The statement, which noted that investigations into the hack were still underway, said "an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks."
The statement added that the hack was likely "an intelligence-gathering effort."
Tuesday's joint statement marked the first cohesive response from the intelligence community since the hack was identified, and it contradicted Trump's claims last month that Chinese hackers were responsible.
The statement said the hack was "a serious compromise that will require a sustained and dedicated effort to remediate," adding that private-sector and US government employees have worked to contain the hack since discovering it.
The joint task force also offered additional clarity on which US agencies were targeted.
The statement said less than 10 federal bodies had networks breached, and those agencies included the Treasury, as well as the departments of State, Homeland Security, Commerce, and Energy.
Russian presidential spokesman Dmitry Peskov and the Russian Embassy in the US have denied that Russian hackers orchestrated the attacks. A statement issued on the embassy's Facebook page on December 13 said: "Malicious activities in the information space contradict the principles of the Russian foreign policy, national interests and our understanding of interstate relations."
It added: "Russia does not conduct offensive operations in the cyber domain."
The hack took place over the course of several months, likely beginning as early as March. Hackers entered the SolarWinds system — which monitors servers to prevent outages — via patch updates made by SolarWinds in March and June, the global cybersecurity firm FireEye said in a statement.
As hackers put corrupted code into SolarWinds updates, at least 18,000 SolarWinds customers in the public and private sectors installed tainted updates, according to US intelligence agencies.
The hack was publicly reported last month after FireEye detected the supply-chain attack, saying its own networks were also compromised.
