This blog post will be updated as new information becomes available. Last updated 2021-01-29.

 

Background

On 2020-12-13, FireEye published an update about their recent Red Team tools compromise, linking the attack vector to a larger software supply chain compromise of the Orion network monitoring product from SolarWinds. The initial intrusion into SolarWinds is not described, but after the threat actor gained access to their production systems they successfully trojanised SolarWinds Orion’s software updates to distribute malware consisting of backdoor code embedded in a legitimate SolarWinds software library. FireEye has named this malware SUNBURST. Microsoft has named it Solorigate.

On 2021-01-11 SolarWinds released a statement where they describe new findings from their investigation, giving an updated overview of the timeline of the attack. Their forensics team has found evidence of the threat actor gaining access to their systems in September 2019. Threat actor code was injected in their Orion product software release in October 2019 for what appears to be testing purposes, followed by the malicious backdoor code injection now known as SUNBURST in the following releases starting 2020-02-20. The threat actor remained undetected, but seems to have stopped injecting the malicious code to SolarWinds Orion software updates in June 2020. SolarWinds did not detect the breach until they were notified on 2020-12-12. (Updated 2021-01-12)

Threat Intelligence Assessment

This is a global threat to all SolarWinds Orion platform customers, not only the media described intrusions at FireEye and several US government organisations. SolarWinds has confirmed that as many as 18.000 customers may have downloaded and installed the malicious software updates.

The US CISA issued an emergency directive on 2020-12-13 instructing all US government agencies to disconnect all affected SolarWinds Orion products from the network, citing that the active exploitation carries an unacceptable risk that requires emergency action. CISA has also reported that they have evidence of the threat actor using additional access vectors, other than the SolarWinds Orion platform. In an updated version of CISA's advisory they claims to have evidence that the actor are abusing SAML tokens in other incidents where SolarWinds was not the initial access vector. Microsoft has further described the anomalies they observed from an Identity perspective, which includes SAML- and API-observations and how the patterns can be detected.
(Updated 2020-12-23)

The threat actor operates with high operational security, obfuscating the command and control mechanisms and making use of anti-forensics techniques. Our assessment is that the stealthy and highly sophisticated nature of this breach suggests this is the work of a nation-state threat actor. This assessment is backed by available threat intelligence from our partners. FireEye did not attribute the threat actor, but described it as an unknown threat actor they track as UNC2452. Volexity tracks this threat actor under the name Dark Halo.

In a joint statement by US cyber security and intelligence agencies FBI, CISA, ODNI and NSA, the threat actor is attributed to be an advanced persistent threat actor of Russian origin, and the cyber intrusion campaign is assessed to be part of an ongoing intelligence gathering effort. (Updated 2021-01-06)

Kaspersky has published a report where they describe technical similarities between the SUNBURST malware and a previously identified .NET backdoor malware known as Kazuar. Kazuar was first reported by Palo Alto in 2017, where it was linked to the Turla threat actor group (also known as Uroburos and Snake). (Updated 2021-01-12)

FireEye has published a white paper where they describe how the threat actor has been using their initial access through SolarWinds (and other intrusion vectors such as password spraying) to move laterally from on-premise networks to gain unauthorised access to the victim's Microsoft 365 environment.

For lateral movement and persistence the following techniques have been described:

• "Golden SAML" attack where the threat actor gains access to an on-premise Active Directory Federation Services server, steals a token-signing certificate and uses this to forge tokens for arbitrary users. This will allow the threat actor to bypass normal authentication methods using passwords and multi-factor authentication.
• Modification or addition of "Trusted Domains" in Microsoft Azure Active Directory. This allows the threat actor to establish an Azure Active Directory backdoor.
• Compromise of user accounts with Azure Active Directory privileged roles by credential theft. This can be used as fallback access for persistence.
• Hijacking existing Azure Active Directory Applications by modifying or adding credentials via the browser or PowerShell. This access can be used to read emails, access user calendars, etc.

Additional information about the threat actor was discussed by FireEye in this webcast. The techniques described show that the threat actor is extremely stealthy. The threat actor has detailed knowledge about corporate systems and leverages their understanding of how SOC employees might detect and investigate malicious activity. The threat actor is using costly dedicated infrastructure and a large number of personnel, possibly spread over multiple teams in a long running campaign. The exfiltrated information is of interest to a state-sponsored threat actor, and has little monetary value (no financial data or PII data). No disruptive activity has been discovered. This points to a state-sponsored threat actor carrying out a very targeted campaign with espionage as their main motivation. (Updated 2021-01-29)

SUPERNOVA

In addition to the SUNBURST malware, another malware is discovered in the SolarWinds platform known as SUPERNOVA. This malware seems to be related to another threat actor than UNC2452/Dark Halo according to Microsoft and FireEye.

This malware serves a webshell in the SolarWinds HTTP API which receives C# script from web request and compile and execute it on the fly. It is not digitally signed and is found in the dll named App_Web_logoimagehandler.ashx.b6031896.dll (md5: 56ceb6d0011d87b6e4d7023d7ef85676). Further technical details can be found here. (Updated 2020-12-23)

SUNSPOT

Crowdstrike has been assisting SolarWinds in their investigation, and has published an analysis of a malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion product. They have named this malware SUNSPOT. SUNSPOT monitors and hijacks processes involved in the compilation of code and replaces one of the source files with a malicious source file containing the SUNBURST backdoor. Several safeguards were added to ensure that software builds did not fail, making it less likely that SolarWinds developers detected the injected code in the software update packages. (Updated 2021-01-12)

TEARDROP and RAINDROP

The threat actor carried out a highly targeted campaign where only a select few of the victims, that installed the backdoor code via SolarWinds software, were further infected by a second stage malware in the form of Cobalt Strike implants. The second stage malware was installed via a loader, named TEARDROP by FireEye, and a variant named RAINDROP by Symantec. Microsoft gives a detailed description in this blog post of how the threat actor activated the SUNBURST backdoor for installing the second stage malware in a very stealthy operation using hands-on keyboard activity, scripts and malware loaders customised per victim. (Updated 2021-01-29)

Affected Systems

According to SolarWinds, the following products are affected: