SUNBURSTMalware
- solorigate
FireEye describes SUNBURST as a trojanized SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. After an initial dormant period of up to two weeks, it uses a DGA to generate specific subdomains for a set C&C domain.From MISP Galaxy
Last reported 3 years ago, by Huntress4 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“… challenging and time-consuming to identify persistence mechanisms left by an advanced adversary as we saw in the 2020 SUNBURST supply chain compromise.”
- T1036Masquerading
“Initial C2 traffic blends into the normal network activity, masquerading as the Orion Improvement Program (OIP) to look like legitimate SolarWinds operations.”
- T1053.005Scheduled Task
“Other mechanisms, such as credential harvesting for abusing remote logins, remote scheduled tasks, PowerShell and WMI-based mechanisms, and other standard lateral movement techniques are equally relevant.”
- T1606.002SAML Tokens
“…ttackers were able to gain administrative access and even compromise SAML token signing certificates — allowing the attacker to forge SAML tokens.”
What the reports say
4 reports, newest first · the exact sentence from each-
Contextualizing Events & Enabling Defense: What 3CX Means“More nuanced approaches to targeting and delivery through various checks and other items may be more stealthy, but as viewed in the SUNBURST payload injected into SolarWinds Orion, even these will leave behind artifacts for follow-up, such as the anomalous network connections use…”
-
Identifying beaconing malware using Elastic“It can often be challenging and time-consuming to identify persistence mechanisms left by an advanced adversary as we saw in the 2020 SUNBURST supply chain compromise.”
-
Bug Bounties for the 99%“The SolarWinds SUNBURST (2020) and the Kaseya ransomware attack (2021) put such a spotlight on supply chain attacks that both CISA and cyber insurance carriers became incredibly vocal about the massive risk managed service providers can have on their end customers.”
-
Supply Chain Exploitation of SolarWinds Orion Software“…ply chain attack trojanized SolarWinds Orion business software updates in order to distribute malware that has been referred to as both SUNBURST and Solorigate.”
Indicators in its reports
named in the reports above- www.solarwinds[.]comin 1 report
- hxxps://www.solarwinds[.]com/securityadvisoryin 1 report
- 192.99.221[.]77in 1 report
- 83.171.237[.]173in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.