Colonial pipeline is back online, but concerns remain

President Biden on Thursday confirmed that the cyber criminals involved in launching a ransomware attack that disrupted operations at Colonial Pipeline last week are likely based in Russia, though he said officials do not believe that the Russian government was involved.

“We do not believe the Russian government was involved in this attack, but we do have strong reason to believe that the criminals who did the attack are living in Russia, that’s where it came from,” Biden said, citing findings from the FBI.

“We have been in direct communication with Moscow about the imperative for responsible countries to take decisive action against ransomware networks,” he noted. “We are also going to pursue a measure to disrupt their ability to operate.”

Asked directly if he was confident Russian President Vladimir Putin was not involved, Biden emphasized that the FBI did not believe Putin was involved.

Biden’s comments came the day after Colonial Pipeline announced that it would resume operations after several days of being shut down due to an attack using what the FBI identified as the “DarkSide” ransomware variant.

As part of his remarks, Biden urged Americans not to panic about fuel shortages, and warned against hoarding gasoline as the Colonial Pipeline ramped back up to full operation.

The comments came the day after Biden signed an executive order taking a range of actions to increase federal cybersecurity.

 Colonial Pipeline paid almost $5 million in ransom to hackers last Friday despite reports that said the company had no intention of paying, Bloomberg news reported.

Sources familiar with the matter told Bloomberg that the company paid in untraceable cryptocurrency within hours of the attack. After the hackers received the payment, they provided the operator with a decrypting tool to restore its computer network.

However, one of the people said the tool was so slow that the company continued to use its own backups to help restore its system.

President Biden declined to comment when asked by a reporter on Thursday whether he was briefed on the company’s decision to pay the ransom.