Back to Recollections
Expert
2020
Supply Chain Compromise
Target: SolarWinds Orion Platform
Impact: Global Espionage
Operational Briefing
The ultimate stealth attack. Inject malicious code into a trusted software update build pipeline.
The Full Story
The SolarWinds hack, also known as Sunburst, was a sophisticated supply chain attack. Hackers compromised the build system of the SolarWinds Orion monitoring software and injected a backdoor into legitimate updates.
Approximately 18,000 customers installed the malicious update, including multiple US federal agencies and Fortune 500 companies.
Technical Analysis
Sunburst Backdoor
- Trojanized Update: The malware lived inside
SolarWinds.Orion.Core.BusinessLayer.dll, digitally signed by a valid certificate. - Dormancy: The backdoor waited 12-14 days before activating to avoid sandbox definition.
- C2 Traffic: Communicated via covert DNS queries and HTTP traffic mimicking legitimate SolarWinds operations (OIP).
Available Modes
Offensive
Replicate the attack vector
Defensive
Harden systems & patch
Analysis
Forensic investigation
Event Timeline
Sept 2019
Threat actors access SolarWinds network.
Feb 2020
Sunburst injected into Orion builds.
Mar 2020
Trojanized updates distributed to customers.
Dec 2020
FireEye discovers the breach after being hacked.
#Supply Chain#Backdoor#Nation-State