Did Russian hackers blow up a Texas LNG pipeline on June 8?

Washington Examiner ^ | June 21, 2022 02:14 PM | Tom Rogan

[Zhang Fei]

According to two sources, around the time of Russia's late February invasion of Ukraine, a cyber unit of Russia's GRU military intelligence service again conducted targeting-reconnaissance operations against a major U.S. liquefied natural gas exporter, Freeport LNG.

U.S. LNG exports have long been a priority concern for Russia, viewed by Russian President Vladimir Putin as a means for the United States to undercut Russia's domination of the European gas market.

On June 8, Freeport LNG suffered an explosion at its liquefaction plant and export terminal on Texas's Quintana Island. The damage suffered means the facility is not expected to resume major operations until late 2022. The June 8 disruption had an immediate impact in spiking already soaring European gas prices and has reinforced Russia's ability to hold gas supplies to Europe at risk in retaliation for the European Union sanctions imposed on Russia over the war in Ukraine. U.S. LNG futures have fallen significantly since the explosion.

One source tells me that the FBI is investigating the cause of the explosion. Responding to a question as to whether the FBI and its Cyber Division were involved in the investigation, the FBI told the Washington Examiner, "We can neither confirm nor deny the existence of an investigation into this matter."

But what actually happened on June 8?

Well, a June 14 press release from Freeport LNG notes that "the incident occurred in pipe racks that support the transfer of LNG from the facility's LNG storage tank area to the terminal's dock facilities. ... Preliminary observations suggest that the incident resulted from the overpressure and rupture of a segment of an LNG transfer line, leading to the rapid flashing of LNG and the release and ignition of the natural gas vapor cloud. Additional investigation is underway to determine the underlying precipitating events

[Zhang Fei]

Ukraine ping

People have apocalyptic visions of American retaliation. In real life, various countries have done all kinds of things without any serious response. And it’s not even unique to the US. Here’s a list of things where either no or minimal response resulted:

(1) the attack on the Panay by Imperial Japan
(2) the taking of the Pueblo by North Korea
(3) the taking of the Mayaguez by Cambodia
(4) the Russian shootdown of KAL007 in 1983, which killed a
Congressman and 63 Americans
(5) the downing of Pan Am 103 by Libya in 1988 which killed 190 Americans
(6) the 1993 attack on the World Trade Center by bin Laden

Taking out an oil pipeline is a footnote, relative to those other things. And many of these other countries lacked any serious ability to retaliate if the US decided to, for instance, burn their hometowns to the ground.

Update by AdmSmith:

---

[XENOTIME rose to prominence in December 2017 when Dragos and FireEye jointly published details of TRISIS (also known as TRITON, the focus of the MITRE Engenuity ATT&CK® Evaluations for ICS) destructive malware targeting Schneider Electric’s Triconex safety instrumented system.

https://www.dragos.com/threat/xenotime/

MITRE report https://attack.mitre.org/groups/G0088/

Oct 23, 2020
WHEN MYSTERIOUS HACKERS triggered the shutdown of a Saudi Arabian oil refinery in August of 2017, the subsequent investigation found that the malware used in that attack had unprecedented, uniquely lethal potential: It was intended to disable safety systems in the plant designed to prevent dangerous conditions that could lead to leaks or explosions. Now, three years later, at least one Russian organization responsible for that callous cyberattack is being held to account.

Today the US Treasury imposed sanctions on Russia’s Central Scientific Research Institute of Chemistry and Mechanics, the organization that exactly two years ago was revealed to have played a role in the hacking operation that used that malware known as Triton or Trisis, intended to sabotage the Petro Rabigh refinery’s safety devices. Triton was designed specifically to exploit a vulnerability in the Triconex-branded “safety-instrumented systems” sold by Schneider Electric. Instead, it triggered a failsafe mechanism that shut down the Rabigh plant altogether.

The hackers who deployed Triton, given the name Xenotime by the industrial cybersecurity firm Dragos, have also probed US power grid targets, according to Dragos and the Electric Information Sharing and Analysis Center, scanning for points of entry into the networks of American utilities.

https://www.wired.com/story/russia-sanctions-triton-malware/

Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware
https://home.treasury.gov/news/press-releases/sm1162

References https://malpedia.caad.fkie.fraunhofer.de/actor/xenotime

We have to wait for the report, but it is not unlikely that this group was responsible.]

[Rdct29]

It wouldn't surprise me if Russia did it. We are giving direct support to a country they are at war with. We even brag about helping Ukraine kill Russian military brass. Our open border leaves us highly vulnerable to terrorist attacks.

[Widget Jr]

No.

There was no explosion or widespread destruction of any kind. When a story starts by exaggerating what actually happened, when there was extensive coverage and video of what happened, the story is clickbait and the "anonymous experts" do not know what they are talking about - if they exist at all.

There was a gas leak and a fire that was contained and controlled fast. Any damage that impairs function of a facility like that is going to take a long time to fix. More likely reduced maintenance due to Covid is catch up to manufacturing and processing industries.

[Zhang Fei]

[No.

There was no explosion or widespread destruction of any kind. When a story starts by exaggerating what actually happened, when there was extensive coverage and video of what happened, the story is clickbait and the “anonymous experts” do not know what they are talking about - if they exist at all.

There was a gas leak and a fire that was contained and controlled fast. Any damage that impairs function of a facility like that is going to take a long time to fix. More likely reduced maintenance due to Covid is catch up to manufacturing and processing industries. ]

---

Thanks. That’s what I expected. I understand that labor shortages have hit the sector especially hard, especially given the radical downsizing during the crash in energy prices. A big chunk of those employees left the sector for good, never to return. The instability is not everyone’s cup of tea. The Biden administration’s promise to wipe the sector out isn’t exactly what people looking for a long-term career are looking to hear.

[mac_truck]

Disinformation agent Zhang Fei runs his own spreader network openly on FR.

[EEGator]

According to Zhang, Russia is losing in Ukraine.
I guess we can stop giving any aid now.
And if Russia is losing, there is to be zero concern for Lithuania as well.

[mac_truck]

I’m sure he’s paid by some foreign government to push that narrative...and the aging neocons here lap it up. 🤡🌎

[EEGator]

Permanent Cold War brains...

Globohomo is far more dangerous to the US and long term decency and freedom.

[kvanbrunt2]

The FBI can only connect Russians to Trump. They will never find out what actually happened. Unless they find a trump maga hat in the rubble.

[gleeaikin]

“(5) the 1993 attack on the World Trade Center by bin Laden” is a classic example of an event that if not acted on effectively can result in something a lot worse. Nine/eleven anyone?

[gleeaikin]

Disinformation agents mac_truck and EEGator return the favor.

It is very important that we all be very, very afraid at any hint of Putin/Russian sabotage activity. Therefore we must exagerate any incident even if just an accident to maintain the fear and reduce the ability to focus attention and time on events that might be the real thing.

[gleeaikin]

Jeez! Listen to Pooty Pals truck and Gator accusing others of doing exactly what I have watched them do for the past 4 months. Any guesses as to which foreign government is pushing these narratives that Ukraine is loosing and Lithuania is in danger?

I had no opinion on the troll issue 4 months ago, but watching is learning, and you can learn a lot by seeing who consistently says negative things about Ukraine, suggests Zelensky is light in the loafers, and Putin is just a sincere Russian patriot. Don’t take my word for it, be skeptical and keep score of who says what about whom.

[mac_truck]

Here's a newsflash for your neo-clown ping list, dotard.

[alexander_busek]

Seems like an obvious design flaw if such a thing was possible .

The "Most Unhelpful Posting of the Day" Award goes to escapefromboston.

That could be said about virtually any incident, from the commercial airliners flying into the Twin Towers to the Uvalde School Massacre to the 1940 Tacoma Narrows Bridge Event.

Regards,

[escapefromboston]

If it was possible to hack into an airplane and crash it then I would call that an obvious design flaw.

[EEGator]

If I am an agent, who am I working for?

[mabarker1]

I’d be very curious to know of any SCADA system that is connected to the internet.

I know of several Water Treatment Plants that are connected 24/7/365 with very minimal Firewall/Hard disconnect. I’m talking about Plants for Municipalities that treat anywhere from 2 MGD to 100 MGD (Million Gallons a Day).

I’d be willing to say that if I downloaded a very commonly used Remote Access Software package and spent 20-30 minutes I could “walk” right in to their SCADA and control the entire Plant, Chemical Dosage Pumps and the connected Remote Pump and Storage Tank Sights. I could do anything from shut the Plant down, make Chemical adjustments to cause sickness, over or under fill storage tanks or even over pressure the distribution lines and cause ruptured lines in one or more locations.

It’s a good thing that I have scruples...

[mabarker1]

Mossad— when the job must absolutely and positively be done to create maximum mayhem and still have fun doing it.

[mabarker1]

Damned Skippy on that !!!

[SkyDancer]

We’re on a well, static level is at 90ft - aquifer is 300 plus feet down. All glacier water from the mountains behind us.