SolarWinds Supply Chain Attack - CloudSEK
The SolarWinds supply chain attack compromised the Orion software build process in 2020, placing the SUNBURST backdoor in legitimate vendor updates that reached enterprise customers through normal distribution channels.
The SolarWinds supply chain attack represented a sophisticated compromise of the Orion software build process, which occurred in 2020. Attackers successfully placed the SUNBURST backdoor inside legitimate vendor updates, allowing malicious code to reach enterprise customers through normal distribution channels. The incident became public knowledge in December 2020 and later underwent examination by the U.S. Government Accountability Office as part of its federal cybersecurity review.
Orion, SolarWinds' network monitoring and management platform, held a trusted position within enterprise IT environments. Organizations relied on Orion to monitor servers, network devices, and infrastructure across both on-premises and hosted systems. Some deployments possessed extensive network visibility and elevated management privileges, making them attractive targets for attackers seeking access to sensitive infrastructure.
The attack exploited a fundamental security challenge: customers had limited visibility into SolarWinds' internal software production processes while depending on the vendor to develop and maintain Orion. This division of responsibility made the integrity of the vendor's development environment critically important to customer security.
Attack Mechanics
Intruders penetrated SolarWinds' development environment and manipulated the Orion build process using SUNSPOT, which facilitated the insertion of SUNBURST functionality into the software. The malicious code employed concealment techniques to avoid immediate detection. The altered build produced releases containing SUNBURST, specifically modifications to SolarWinds.Orion.Core.BusinessLayer.dll, which became part of official Orion packages distributed through established update channels.
When affected Orion installations loaded the modified DLL, SUNBURST code could execute within the application. The backdoor exhibited staged behavior: it would wait and check environmental conditions before attempting communications with attacker-controlled domains. DNS responses could redirect particular installations to interactive command-and-control infrastructure for further instructions.
Discovery and Attribution
SolarWinds' investigation traced suspicious internal activity to 2019, though the compromise became public later. FireEye discovered evidence of the altered Orion component during its investigation into a breach of its own systems, connecting the incident to software from an outside vendor. The company's December 17, 2020 update described its investigation and response, triggering reviews across government and industry.
In April 2021, the United States and United Kingdom publicly attributed the campaign to Russia's Foreign Intelligence Service (SVR). MITRE ATT&CK records the SolarWinds Compromise as campaign C0024 and associates it with APT29, though researchers have also used various designations like UNC2452 and NOBELIUM for related activity.
The decisive transitions took place between the vendor's internal systems, its release channel, and infrastructure managed by customers. Responsibility for protecting those environments, along with the evidence available to investigators, changed at each boundary.
Impact Assessment
According to SolarWinds' December 14, 2020 SEC filing, up to 18,000 customers had potentially downloaded the implicated Orion releases. However, this represented an estimate of potentially affected downloads, not confirmed intrusions. Using DNS evidence, SolarWinds later estimated that fewer than 100 customers had been hacked through SUNBURST.
The attack's complexity made detection particularly challenging. SUNBURST operated within an authentic Orion component, bypassing publisher-authenticity checks. The backdoor's delayed activation and traffic that resembled legitimate Orion communications further obscured its presence. Additionally, attackers selectively used valid accounts and familiar administrative mechanisms to conceal unauthorized actions after gaining initial access.
Related
