SolarWinds: Trusted update carries a spy

A company installs an update to its monitoring tool. This is normally a maintenance and safety gesture. In the SolarWinds case revealed in 2020, this habit becomes a gateway: some Orion updates contain a malicious component called SUNBURST.

The intrusion targets the software manufacturing chain. Hostile code is embedded before distribution, allowing it to travel in a product that customers have good reasons to accept. The trust given to the supplier thus facilitates his arrival to the victims.

The presence of a trapped update does not mean that each customer then receives the same exploitation. Operators choose targets and pursue certain intrusions to gain additional access, information, or identities. The number of installations exposed and the number of organisations actively spied on are different.

FireEye’s investigations reveal the campaign and lead to the analysis of the compromised component. Authorities are issuing emergency instructions, including disconnecting the affected facilities, while teams seek persistent access that attackers have been able to obtain.

In April 2021, the US and British authorities attributed this operation to the Russian foreign intelligence service, the SVR. Researchers link it to the actor typically followed as APT29. This is not the story of a ransom paid to recover a server.

SolarWinds shows why a defense cannot be limited to denying obviously suspicious files. The dangerous file can arrive at the right time, through the right channel, in the name of the right provider.