Russia will target US agriculture with cyber attacks

Among the cyber-security industry, many consider Russia to be the most capable and stealthiest of America’s cyber adversaries. In addition to the notable intrusions mentioned earlier, suspected Russian adversary groups have earned their reputation for several reasons, including developing sophisticated malware that employed novel command and control techniques, exhibiting rapid breakout times, and leading the way in targeting cloud infrastructure.36

Cyber attacks crippling the food industry are not unprecedented. For example, suspected criminals successfully compromised the network of JBS S.A., a global meat processing company, hampering livestock slaughter operations and causing wholesale meat prices to spike.37 Should the Kremlin set its sights on disrupting the U.S. wheat industry via cyber means, a likely approach would be targeting the infrastructure used for grain transport and storage, specifically the grain storage elevators throughout wheat production regions. These facilities comprise an essential component of the Nation’s food system, which the Department of Homeland Security (DHS) has identified as 1 of the 16 sectors of critical infrastructure.38 Farming cooperatives operating grain elevators increasingly leverage automation technologies to handle loading and unloading functions. If an adversary gained remote access to the industrial control system (ICS) network environment, they could shut down operations, preventing grain transportation to trade markets and food processors.

Russian state-sponsored adversaries are known to have successfully targeted a critical infrastructure ICS environment, causing kinetic effects. A cyber unit within the Russian military was responsible for the attack on the Ukrainian power grid, resulting in nearly a quarter-million Ukrainians losing power for about 6 hours.39 A similar attack chain methodology could disrupt control systems for other sectors of critical infrastructure, such as grain storage facilities.

A less sophisticated means of attack on grain elevators would be to infect the traditional computer networks operating at these facilities in attempts to affect operations. This has already happened on several occasions. Between the fall of 2021 and early 2022, six U.S. grain cooperative elevator facilities experienced ransomware attacks on their business networks that inhibited processing as some were forced to adjust to manual operations. Recognizing the threatening trend, the Federal Bureau of Investigation (FBI)’s Cyber Division issued a Private Industry Notice to assist grain cooperative organizations better prepare their defenses.40 The FBI’s report also noted the potential for an impact on commodities trading and stocks that could result in food security and inflation concerns.

Another potential cyber attack against the wheat industry that could lead to severe outcomes would be a more typical intrusion into agriculture industry business networks. Large agriculture firms have not been immune from network intrusions aimed at stealing intellectual property. Unlike the other attacks mentioned, where the objective is to perform sabotage or shut down a network for ransom, cyber-security firms have noted that intellectual property theft intrusions targeting agriculture firms are on the rise.41

Should Russian-aligned adversaries gain access to sensitive agriculture industry data, they could facilitate further disruptive strategies. For example, stolen documents and data could be altered and then leaked publicly, delivering damaging false messages like the hackers who doctored data stolen from Pfizer to undermine public trust in vaccines.42 Similarly, grain pathology and trade experts note that false claims of wheat crop disease would have dramatic adverse effects on American grain exports.43 Undermining American interests related to global trade introduces additional options at the Kremlin’s disposal for disrupting U.S. wheat production.