{"id":5823,"date":"2020-12-22T16:28:08","date_gmt":"2020-12-23T00:28:08","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=5823"},"modified":"2024-08-07T12:22:35","modified_gmt":"2024-08-07T19:22:35","slug":"solarwinds-and-sunburst-update","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/solarwinds-and-sunburst-update\/","title":{"rendered":"SolarWinds and SUNBURST Update"},"content":{"rendered":"

Authors: Victor Sandin and Darby Wise
\nTLP:WHITE<\/p>\n

1.\u00a0 Executive Summary<\/h3>\n

On 15 December, Infoblox released a Cyber Threat Advisory on the supply chain attack affecting SolarWinds\u2019 Orion IT monitoring and management software.1<\/sup> This advisory detailed FireEye\u2019s report on the campaign, including analysis on the SUNBURST backdoor, initial information on the threat actor\u2019s tactics, techniques and procedures (TTPs), as well as the mitigations and indicators of compromise (IOCs) that were most current at the time.2<\/sup> The threat actor behind the campaign carried out a complex attack chain and demonstrated highly sophisticated TTPs, indicating it was the work of an advanced persistent threat (APT) group. Known victims include government agencies, as well as private sector and critical infrastructure organizations.3<\/sup><\/p>\n

Since the publishing of our previous report, we have gathered additional information about the wide-ranging effects of this campaign, and are conducting several internal investigations. We are publishing this update to share some of the latest information from OSINT, as well as convey what we have been able to validate. This report also includes additional IOCs.<\/p>\n

2.\u00a0 Analysis<\/h3>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2.1.\u00a0 \u00a0Updates on Supply Chain Attack<\/h4>\n

As previously reported, the threat actor used a highly sophisticated attack chain to deliver malicious code via a backdoor injected into a dynamic-link library (DLL) that was a part of a legitimate update to some versions of SolarWinds Orion software (SolarWinds.Orion.Core.BusinessLayer.dll<\/em>). Based on the update release date and passive DNS (pDNS) data, this breach started as early as March 2020. However, ReversingLabs has reportedly found that in October 2019, the threat actor distributed malicious files without the embedded backdoor to test whether or not these files would be detected.4<\/sup><\/p>\n

The threat actor was able to remain undetected for an extended period of time by employing sophisticated obfuscation methods such as imitating the legitimate SolarWinds coding style and naming standards, using virtual private servers (VPSs) with IPs native to the victim\u2019s home country, and leveraging compromised security tokens for lateral movement. Further analysis indicates that the threat actor used escalated Active Directory privileges to compromise the Security Assertion Markup Language (SAML) signing certificate and create valid tokens that could be used to access environment resources for data exfiltration.<\/p>\n

According to a new alert from the Cybersecurity and Infrastructure Security Agency (CISA), it appears that the threat actor used multiple initial access vectors in addition to the SolarWinds Orion platforms. Volexity reported to have evidence connecting the TTPs from this campaign to multiple incidents from late 2019 and early 2020 targeting a US-based think tank. Volexity designated the actor responsible for these attacks Dark Halo.5<\/sup> In one of these incidents, Volexity observed the APT using a stolen secret key, known as an akey, to generate a cookie to bypass the Duo multi-factor authentication (MFA) service and access a user\u2019s email via the Outlook Web App (OWA). While we are still investigating our non-Orion products, to date, we have not seen evidence that they are impacted by SUNBURST.<\/p>\n

Our previous report included information from FireEye stating the APT deployed other variants of malware as additional payloads, including TEARDROP, SUPERNOVA, and COSIMICGALE. Since then, ZDNet has come out in agreement that the threat actor downloaded TEARDROP, a memory-only dropper, but also reported that security researchers\u2019 and Microsoft\u2019s further analysis indicates SUPERNOVA and COSMICGALE were not part of this campaign\u2019s attack chain and should be considered as a separate attack targeting CVE-2019-8917.6<\/sup><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2.2.\u00a0 \u00a0Decoding the DGA Algorithm<\/h4>\n

Several teams have published findings pertaining to decoding the elements of the FQDNs created by the threat actor\u2019s DGA. The RedDrip Team from QiAnXin Technology published a decoder and that the structures of the subdomains were composed of three parts: a globally unique identifier (GUID) value composed of the hash of the hostname and MAC address of the first or default active and non-loopback interface; a single byte indicating if it is the first, second or third part of the payload (infected system domain name); and finally, a custom base32-encoded hostname to identify the victim. Longer domains are split across multiple queries and assembled later by matching the GUID section after applying a byte-by-byte exclusive OR.7,8<\/sup><\/p>\n