{"id":6245,"date":"2021-04-20T11:17:10","date_gmt":"2021-04-20T18:17:10","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6245"},"modified":"2024-04-26T13:20:45","modified_gmt":"2024-04-26T20:20:45","slug":"solarwinds-third-update","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/solarwinds-third-update\/","title":{"rendered":"SolarWinds Third Update"},"content":{"rendered":"

Author: Shashank Jain<\/h3>\n

TLP: WHITE<\/h3>\n

 <\/p>\n

1.\u00a0 Executive Summary<\/h3>\n

On 15 December, Infoblox released a Cyber Threat Advisory on the supply chain attack affecting SolarWinds\u2019 Orion IT monitoring and management software.1<\/sup> This advisory detailed FireEye\u2019s report on the campaign, including analysis on the SUNBURST backdoor, initial information on the threat actor\u2019s tactics, techniques and procedures (TTPs), as well as the mitigations and indicators of compromise (IOCs) that were most current at the time.<\/p>\n

On 15 April, the Biden administration released a statement2<\/sup> formally attributing the SolarWinds supply chain compromise to Russian Foreign Intelligence Service (SVR) actors (also known as APT29, Cozy Bear, and the Dukes). The statement reported that the compromise of the SolarWinds software supply chain gave threat actors the ability to spy on or potentially disrupt more than 16,000 computer systems worldwide, including U.S. government agencies, business customers, consulting firms, and more.<\/p>\n

Infoblox published several Cyber Threat Advisories3<\/sup> about this campaign, as well as additional information about its wide-ranging effects after conducting several internal investigations. We also summarized some of the latest information from OSINT, conveyed what we were able to validate at the time, and provided additional IOCs.<\/p>\n

In this update, we have included new information provided by the latest alert4<\/sup> from the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense (DoD) Cyber National Mission Force (CNMF) on additional SolarWinds-related malware variants – referred to as SUNSHUTTLE and SOLARFLARE.<\/p>\n

This update also extended to cover recent Russian SVR activities, including compromising SolarWinds Orion software updates,5<\/sup> targeting COVID-19 research facilities through deploying WellMess malware and leveraging a VMware vulnerability that was zero-day at the time for follow-on Security Assertion Markup Language (SAML) authentication abuse.<\/p>\n

2.\u00a0 Analysis<\/h3>\n

2.1.\u00a0 \u00a0New SolarWinds-Related Malware Variants<\/h4>\n

CISA and the DoD have reported additional malware variants related to SolarWinds: SUNSHUTTLE and SOLARFLARE. The identified malicious samples and associated artifacts can be attributed to the Russian SVR based on the methods and patterns used throughout their hacking operation.<\/p>\n

The analysis covered a total of 18 files:<\/p>\n