SolarWinds Orion Updates Trojans Used to Deliver SUNBURST Backdoor
Summary
A trojanized SolarWinds Orion update distributed the SUNBURST backdoor, which could provide network access and deliver further payloads. The article describes affected versions, emerging detections, and recommended updates and mitigations.
Key points
- The article says Orion updates released between March and June 2020 were tainted; listed affected builds were 2019.4 HF 5, 2020.2 without a hotfix, and 2020.2 HF 1.
- The backdoor was delivered through a malicious DLL in routine or automatic software updates and was signed with a legitimate SolarWinds certificate.
- The DLL contacted command-and-control infrastructure, with initial traffic masquerading as SolarWinds Orion Improvement Program activity.
- The article reports that attackers could scan systems, exfiltrate data, or steal credentials; Microsoft research indicated some gained administrative access and compromised SAML token-signing certificates.
- The attackers’ motivation was unclear; the article characterized the activity as narrow and targeted, and said the campaign might have begun in spring 2020.
- Recommended actions included updating affected Orion builds, following CISA’s emergency directive, and updating endpoint security detections.
- Huntress said it had seen evidence tied to Orion, not N-central or RMM, and created monitored-file checks to identify endpoints containing the backdoored DLL.
Article Details
- Event Type
- Supply-chain compromise of SolarWinds Orion software updates, which were trojanized to distribute the SUNBURST backdoor (also called Solorigate).
- Impact
- Affected Orion versions 2019.4 HF 5 and 2020.2 without a hotfix or 2020.2 HF 1. The malicious, SolarWinds-signed DLL enabled attackers to gain a foothold, scan systems, potentially exfiltrate data or steal credentials, and receive further commands and payloads through C2. Microsoft research indicated some attackers gained administrative access and compromised SAML token-signing certificates, potentially enabling forged tokens to access privileged resources. The article says the incident appeared highly targeted and nation-state-linked, while the attackers’ motivation remained unclear.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article says attackers could steal credentials; it does not specify the credential-access method.T1041 · Exfiltration Over C2 ChannelThe article says attackers could exfiltrate data from compromised environments.T1071 · Application Layer ProtocolThe malicious DLL communicated with C2 infrastructure to receive commands and payloads.T1071.004 · DNSInitial C2 traffic masqueraded as the Orion Improvement Program (OIP) to blend into normal network activity.T1083 · File and Directory DiscoveryAfter loading, the backdoor could scan the compromised system.T1195.002 · Compromise Software Supply ChainAttackers trojanized SolarWinds Orion software updates to distribute the backdoor.T1550.004 · Web Session CookieThe article reports that attackers compromised SAML token-signing certificates and forged SAML tokens to potentially access privileged resources.
People
Malware
Vendors
FireEyeOn December 13, FireEye discovered that SolarWinds Orion products (versions 2019.4 HF 5 and 2020.2 with no hotfix or 2020.2 HF 1) were being exploited by malicious actors. The supply chain attack trojanized SolarWindsMicrosoftMarch 2020 and June 2020 have been tainted with malware, which FireEye was first to name SUNBURST. Microsoft has separately named this malware Solorigate and added detection rules to its Defender antivirus.SolarWindsHomeBlogSupply Chain Exploitation of SolarWinds Orion Software
Products
Microsoft Defender Antimalware PlatformFor users of our Managed AV beta, we are able to see if this Microsoft Defender threat was detected. At the time of publishing, we have not seen any instances detected.SolarWinds N-centralAs far as we know at time of publishing, this does not affect SolarWinds N-central or SolarWinds RMM. Our team is actively digging into this — you can follow along here.SolarWinds OrionHomeBlogSupply Chain Exploitation of SolarWinds Orion SoftwareSolarWinds RMMAs far as we know at time of publishing, this does not affect SolarWinds N-central or SolarWinds RMM. Our team is actively digging into this — you can follow along here.