Threat Hunt Deep Dives: SolarWinds' Supply-Chain Compromise (Solorigate / SUNBURST Backdoor)

On December 13th 2020, it was unveiled by FireEye that SolarWinds has been impacted by a sophisticated supply chain compromise affecting their SolarWinds Orion software. A malicious backdoor was found to be present in the compromised software that FireEye has dubbed the SUNBURST backdoor. The impact of this compromise has been severe, SolarWinds boasts over 300,000+ customers world-wide and supplies its software to high-profile customers such as the majority of the Fortune 500, all five branches of the U.S. military, and many U.S. government agencies. The SolarWinds Orion software is an IT Management and Network Management System (NMS) which typically have access to key network infrastructure including network appliances, servers, and workstations making it a highly desirable target for attackers.

FireEye, the U.S. Department of the Treasury, and the U.S. Department of Commerce have all been compromised by this attack. The nature of the supply chain compromise, high-level profile of the attacks, and the malicious actors extreme attention to detail regarding operational security during post-exploitation have led to many reports regarding these attacks as conducted by a nation-state threat actor. Various, highly-regarded sources have attributed this attack to APT29 (aka Cozy Bear) which is believed to be associated with the Russian Foreign Intelligence Service (SVR).