Poisoned Pipeline / Incidents / AS6
SolarWinds
Windows softwareInstaller / update channel
The SolarWinds incident, one of the most significant cyberattacks in recent history, began when hackers gained unauthorized access to the internal network of SolarWinds, a prominent IT management software provider. In 2019, they injected malicious code into SolarWinds' widely used Orion software, which was unknowingly distributed to around 18,000 customers in a software update released in March 2020. Exploiting this compromise, the hackers conducted targeted cyber-espionage campaigns against various organizations. The breach, attributed to a state-sponsored hacking group believed to be linked to the Russian government, allowed the attackers to gain unauthorized access to systems. In response, directives were issued advising affected organizations to disconnect or power down SolarWinds Orion products. The breach also affected Microsoft, which revealed that the attackers had accessed some of their source code repositories. Investigations, forensic analyses, and mitigation efforts were undertaken to assess the breach's extent, remove the malicious code, and bolster security measures. The incident exposed the attackers' sophistication and highlighted the vulnerability of trusted software supply chains, underscoring the importance of robust cybersecurity measures.
Mapped techniques
- T0142 Accidental public disclosure of internal resources
- T0105 Active scanning
- T0153 Compromised developer workstation
- T0135 Vulnerable CICD system
- T0113 Compromised user account
- T0191 Malicious code in artifacts
- T0208 Compromise code-signing identity
- T0206 Forge or omit build provenance
- T0172 Runtime backdoor
- T0201 Customers compromised
- T0200 Proprietary data stolen
supply-chain SolarWinds
The password "solarwinds123," was discovered in 2019 on the public internet by an independent security researcher who warned the company that the leak had exposed a SolarWinds file server. According to the researcher, he was able to use this password to access SolarWinds FTP server.
SolarWinds investigations uncovered evidence that the threat actor compromised credentials and conducted research and surveillance in furtherance of its objectives through persistent access to our software development environment and internal systems, including our Microsoft Office 365 environment,
The exact infection point at SolarWinds is still unknown, but there are a few theories. One theory is that the attackers compromised a developer workstation and used it to upload the malicious code to the SolarWinds Orion software. Another theory is that the attackers exploited a vulnerability in SolarWinds' build process to inject the malicious code. It is also possible that the attackers used a combination of these methods to gain access to SolarWinds' systems.
The exact infection point at SolarWinds is still unknown, but there are a few theories. One theory is that the attackers compromised a developer workstation and used it to upload the malicious code to the SolarWinds Orion software. Another theory is that the attackers exploited a vulnerability in SolarWinds' build process to inject the malicious code. It is also possible that the attackers used a combination of these methods to gain access to SolarWinds' systems.
It is speculated that the attackers employed multiple techniques to compromise user accounts. These methods might have involved the utilization of brute-force attacks or phishing tactics to gain unauthorized access.
It is speculated that the attackers employed multiple techniques to compromise user accounts. These methods might have involved the utilization of brute-force attacks or phishing tactics to gain unauthorized access.
SolarWinds reported that the attacker introduced a backdoor named Sunburst and UNC2452 into the SolarWinds Orion Software. Contrary to altering the source code itself, the attacker injected the malware into the software during the build process, as disclosed by SolarWinds.
Orion updates were signed with SolarWinds' real code-signing identity,
so signature checks on customer endpoints succeeded.
The implant was injected at build time; downstream provenance, if any,
still named the legitimate SolarWinds pipeline.
post-supply-chain SolarWinds Customers
The SolarWinds breach had a potentially significant impact due to the widespread use of the compromised Orion Software in numerous high-profile organizations. These included prominent US agencies, as well as technology giants like Microsoft, Intel, and Cisco. While the specific extent of the damage caused by the breach has not been publicly disclosed, the potential for harm was substantial, considering the stature of these companies as significant suppliers of software in the industry
Downstream Orion customers were the actual intelligence targets. The
supplier compromise existed to reach those networks.
Microsoft and other victims reported access to source-code repositories
and internal mail — proprietary data theft as the espionage payoff.