The US government continues to reel from a large and sophisticated hacking campaign that affected top federal agencies, including the energy department, the treasury and commerce departments, and is even said to have targeted the agency responsible for the country’s nuclear weapons stockpile. Authorities expressed increasing alarm over the hack, suspected to be the work of Russia, warning that it poses “a grave risk” to federal, state and local governments, as well as “critical infrastructure entities”. In a statement on Thursday, the Cybersecurity and Infrastructure Security Agency (Cisa) also warned that it will be difficult to remove the malware inserted through network software. “Removing this threat actor from compromised environments will be highly complex and challenging for organizations,” the agency said. Thursday’s comments were the most detailed yet from the agency since reports of the hack emerged over the weekend. The US government on Wednesday confirmed that an operation by elite hackers affected its networks and said the attack was “significant and ongoing”. The true scale of the breach is still unknown, but looks to have extended beyond the US government. On Thursday, Reuters reported that Microsoft was also hacked as part of the suspected Russian campaign, according to people familiar with the matter. SolarWinds, the company behind the software targeted by hackers, said earlier this week that up to 18,000 of its more than 300,000 customers had downloaded the compromised software. Hackers believed to be working for Russia introduced malware into SolarWind’s popular network safety tool called Orion, which is used by numerous government agencies and large corporations. The hack began as early as March, when malicious code was snuck into updates to Orion, which monitors the computer networks of businesses and governments for outages. That malware gave the hackers remote access to an organization’s networks, including internal emails. The content the hackers sought to steal – and how successful they were – remains unclear. Cisa said it was continuing to analyze the other avenues used by the attackers. So far, the hackers are known to have at least monitored email or other data within the US departments of defense, state, treasury, homeland security and commerce. The US Energy Department also said they have evidence hackers gained access to their networks as part of the massive cyber campaign. Politico had earlier reported the National Nuclear Security Administration, which manages the country’s nuclear weapons stockpile, was targeted. The disclosures raise further national security concerns. The FBI and other agencies have scheduled a classified briefing for members of Congress on Friday. Joe Biden expressed concern over the hacking and said he would make cybersecurity a top priority of his administration, but that stronger defenses are not enough. “We need to disrupt and deter our adversaries from undertaking significant cyberattacks in the first place,” he said on Thursday. “We will do that by, among other things, imposing substantial costs on those responsible for such malicious attacks, including in coordination with our allies and partners.” Two senators on Thursday requested a briefing with the Internal Revenue Service on whether personal taxpayer information has been stolen in the breach. The IRS is housed at the US treasury department, which was impacted by the breach. “Given the extreme sensitivity of personal taxpayer information entrusted to the IRS, and the harm both to Americans’ privacy and our national security that could result from the theft and exploitation of this data by our adversaries, it is imperative that we understand the extent to which the IRS may have been compromised,” senators Chuck Grassley of Iowa and Ron Wyden of Oregon wrote. White House national security adviser Robert O’Brien on Tuesday cut short a European trip to deal with the attack. Meanwhile, homeland security officials have issued an emergency directive telling all federal civilian agencies to review their systems. The command marks only the fifth such directive to be issued by the cybersecurity and infrastructure security agency since it was created in 2015. Experts in the security space say the hacks uncovered so far may be the tip of the iceberg. “With the entire corporate infrastructure potentially suspect, it will take a long-term program to reset these systems back to a trusted baseline,” said Mike Kiser, American sales director at SailPoint, a security and identity management platform. Donald Trump, meanwhile, has yet to publicly address the hacking. On Thursday, Republican Senator Mitt Romney criticized the White House for its “inexcusable silence and inaction”. “This cyber hack is like Russian bombers have been repeatedly flying undetected over our entire country,” Romney said in a statement, adding that it was “past time for a national security re-set that prioritizes cybersecurity capabilities and defenses”. Joan E Greve contributed reporting