The attack, which came to be known as SUNBURST in SolarWinds communications, affected Orion versions 2019.4 through 2020.2.1, released between March and June 2020.
To carry out the attack, hackers modified an Orion platform plugin distributed as part of Orion platform updates. Digitally signed by SolarWinds, it contains a backdoor that communicates with third-party servers under the attackers’ control. Once the attackers established a foothold in impacted organizations, they could steal data, deploy malicious code, or otherwise disrupt business.
The attack was the work of a sophisticated adversary with deep understanding of operational security. Based on publicly available data, this adversary demonstrated significant efforts to evade detection, including code obfuscation and clean-up techniques such as steganography, fingerprinting techniques to identify target systems and analysis systems, rotating infrastructure with a focus on geolocation proximity, and executing code in memory as much as possible.
These techniques, in combination with using a digitally signed component of a trusted software platform as the initial infection vector, indicate a highly skilled and covert adversary willing to expend resources to assure the success of their operation.
US Response and Sanctions Following the Attack
The attack affected multiple high-profile US federal government agencies, including the Department of Justice (DOJ), the Department of Homeland Security (DHS), and the Department of the Treasury, among others. It exposed the Microsoft 365 email environments of various federal agencies, constituting a “major incident” that warranted a defensive response.
A White House statement in April 2021 affirmed that the Biden administration would “impose costs on Russia for actions by its government and intelligence services against U.S. sovereignty and interests.” These actions targeted Russian government, commerce, and intelligence bodies, including the expulsion of diplomatic representatives of Russian intelligence services from the US.
The same statement formally named the Russian Foreign Intelligence Service (SVR) as the perpetrator of the attack. CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) released a joint security advisory that contained further details.
