Full Report
Huntress covers the breaking news about Solarwinds’ Orion platform being exploited as part of a coordinated attack to distribute malware.
Analysis Summary
# Incident Report: Supply Chain Exploitation of SolarWinds Orion Software
## Executive Summary
In December 2020, a highly sophisticated nation-state actor executed a supply chain attack by trojanizing legitimate software updates for the SolarWinds Orion platform. The malware, identified as SUNBURST (or Solorigate), granted attackers a persistent foothold in high-value networks via a backdoor signed with a legitimate SolarWinds certificate. The incident is characterized by its extreme stealth, long duration (dating back to at least March 2020), and targeted nature.
## Incident Details
- **Discovery Date:** December 13, 2020 (by FireEye)
- **Incident Date:** March 2020 – June 2020 (Initial deployment period)
- **Affected Organization:** SolarWinds (specifically Orion platform users)
- **Sector:** Technology / Government / Critical Infrastructure
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 2020
- **Vector:** Supply Chain Compromise
- **Details:** Malicious code was silently injected into the build environment of SolarWinds Orion software updates (versions 2019.4 HF 5 through 2020.2 HF 1).
### Lateral Movement
- **Details:** After the trojanized DLL was executed through a legitimate update, attackers used the foothold to scan internal systems, steal credentials, and move laterally. In some environments, they compromised SAML token signing certificates to forge tokens and access privileged cloud and on-premise resources.
### Data Exfiltration/Impact
- **Details:** Attackers targeted sensitive data and administrative access. The full scope involves the potential compromise of any resource trusting the forged SAML tokens or managed by the Orion platform.
### Detection & Response
- **Discovery:** FireEye identified the activity while investigating a breach of their own internal tools.
- **Response Actions:** FireEye and Microsoft released names (SUNBURST/Solorigate) and detection rules; SolarWinds released hotfixes and advisories; CISA issued emergency directives (implied by the nature of the report).
## Attack Methodology
- **Initial Access:** Supply chain injection (trojanized software update).
- **Persistence:** Implementation of a backdoor via a malicious DLL (`SolarWinds.Orion.Core.BusinessLayer.dll`).
- **Privilege Escalation:** Forging SAML tokens to gain administrative access to broader resources.
- **Defense Evasion:** Used legitimate SolarWinds digital certificates to sign malware; delayed execution to avoid sandbox detection; blended C2 traffic into Orion Improvement Program (OIP) protocols.
- **Credential Access:** Theft of administrative credentials and SAML signing keys.
- **Discovery:** System and network scanning post-infection.
- **Lateral Movement:** Forged tokens and credential abuse.
- **Exfiltration:** Beacons to C2 infrastructure via third-party servers.
- **Impact:** Ongoing unauthorized access and potential data theft.
## Impact Assessment
- **Financial:** Not specified, but expected to be massive due to incident response costs.
- **Data Breach:** Compromise of administrative systems and potential access to any data managed by the Orion platform.
- **Operational:** Widespread requirement for organizations to take Orion servers offline or apply emergency patches.
- **Reputational:** Significant damage to SolarWinds' brand and trust in the global software supply chain.
## Indicators of Compromise
- **Network indicators:** C2 traffic masquerading as Orion Improvement Program (OIP) traffic to external servers (e.g., `avsvmcloud[.]com`).
- **File indicators:** `SolarWinds.Orion.Core.BusinessLayer.dll` (Trojan:MSIL/Solorigate.B!dha).
- **Behavioral indicators:** Unusual SAML token generation and unexpected outbound traffic from monitoring servers.
## Response Actions
- **Containment:** Organizations advised to isolate Orion servers and block associated C2 domains.
- **Eradication:** SolarWinds released Orion Platform version 2020.2.1 HF 2.
- **Recovery:** Full audit of SAML signing certificates and credential resets for all accounts managed by or accessible to Orion.
## Lessons Learned
- **Key takeaways:** Trusted, signed software updates are now a primary attack vector for nation-state actors.
- **Vulnerabilities:** Heavy reliance on a single software suite for network-wide visibility creates a single point of failure.
## Recommendations
- **Zero Trust:** Implement zero-trust architecture to limit the damage of a single compromised administrative tool.
- **Egress Filtering:** Strictly limit outbound internet access for servers running sensitive infrastructure management software.
- **Code Integrity:** Enhance build-pipeline security and implement multi-stage verification for code signing.