Solar Winds, probably hacked by Russia, serves White House, Pentagon, NASA

A suspected Russian hack of internal U.S. Treasury Department emails have sparked fears among domestic intelligence that other government agencies could be at risk, according to people familiar with the matter.

Three unnamed sources familiar with an investigation told the Associated Press on Sunday that Russia is believed to have been behind the cyber attacks. U.S. officials have yet to release details publicly, including who is suspected to be behind the hack, beyond confirming that a breach has occurred. The Commerce Department said that one of its agencies was targeted, and the FBI and Cybersecurity and Infrastructure Security Agency (CISA) are currently investigating the incident.

Two unnamed sources told the outlet that the hackers entered U.S. systems through updates released by SolarWinds, a software company based in Austin, Texas that also provides services to the White House, Pentagon and NASA, according to their website. Additionally, the company provides services to the country’s leading telecommunications providers, as well as “more than 425 of the U.S. Fortune 500.”

Four unnamed sources briefed on the matter said that SolarWinds’ vast network of federal clients has prompted fears among U.S. intelligence officials that those agencies could also be at risk. “This is a much bigger story than one single agency,” one source familiar with the matter said. “This is a huge cyber espionage campaign targeting the U.S. government and its interests.”

On Sunday evening, SolarWinds said a “highly-sophisticated, targeted and manual supply chain attack by a nation state” could have infiltrated its software updates between March and June this year.

The hackers are suspected of utilizing a method, dubbed the “Supply Chain attack,” in which malicious code is embedded into software updates provided to victims. The cyber spies are believed to have surreptitiously monitored federal staff emails for several months after entering the National Telecommunications and Information Administration’s (NTIA) Microsoft 360 Office platform.

The Russian government has denied involvement in the suspected attacks. In a statement shared to Facebook, the country’s foreign ministry called the allegation “another baseless attempt by American media to accuse Russia of hacking on U.S. government authorities.”

“Russia does not conduct ‘offensive’ operations in a virtual environment,” the statement read. “The Russian Federation is actively promoting bilateral and multilateral cybersecurity agreements.”

One source briefed on the matter insisted that the attacks were by “a nation state,” and another called the hackers “highly sophisticated,” according to AP.

All sources spoke on the condition of anonymity due to the sensitive nature of the breach. They say that the official probe is still in its infancy and further details could likely emerge in the coming months.

Newsweek reached out to the FBI for information about the investigation.