Malware
SUNSPOT
- First Reported
- Feb 1, 2021
- Latest Reported
- Oct 28, 2026
Reported Context (2)
- In the SolarWinds breach, SUNSPOT malware replaced a source file during compilation to insert a backdoor, then restored the original afterward. Checking files only before and after the build could miss that temporary StepSecurity Compares Harden-Runner With GitHub Actions’ Native Egress Firewall
- Kaspersky discovers links to a known Russian malware. More info here. CrowdStrike discovers additional malware (SUNSPOT) that injected SUNBURST via CI/CD. More info here. SolarWinds Attack: Cloud Security Detection and Response Guidance
Malware (2)
MITRE ATT&CK (4)
Vendors (8)
Products (14)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.