Loading malware…
SUNBURST is a trojanized DLL backdoor inserted into SolarWinds Orion software updates as part of the 2020 SolarWinds supply-chain compromise. It was distributed through legitimate Orion update channels after attackers compromised the SolarWinds development/build environment and infected Orion source code, resulting in deployment to a broad customer base that included government and enterprise networks. Reporting in the provided content ties the operation to APT29, also tracked as NOBELIUM, Cozy Bear, Dark Halo, and UNC2452, and describes it as a state-backed espionage campaign.
The malware communicated with command-and-control infrastructure over HTTP using GET and POST requests to third-party servers, and its C2 traffic used Base64 encoding. It was observed delaying execution and using anti-analysis and operational security measures in broader reporting on the SolarWinds compromise. SUNBURST checked for antivirus and endpoint detection agents prior to execution and attempted to disable software security services after comparing against a hardcoded FNV-1a + XOR hashed blocklist. It supported commands to write or delete registry keys and was observed stopping services by setting HKLM\SYSTEM\CurrentControlSet\services[service_name]\Start to 4.
On compromised hosts, SUNBURST collected the username and the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid, and used the WMI query "Select * From Win32_SystemDriver" to retrieve a driver listing. It also removed HTTP proxy registry values and deleted previously created IFEO Debugger registry values to clean up traces of activity. The content further states that SUNBURST had the capability to deliver the memory-only dropper TEARDROP, which in turn was observed delivering Cobalt Strike Beacon and other malware.
High-confidence indicators and artifacts directly mentioned in the content include the malware names SUNBURST and Solorigate, its association with SolarWinds Orion trojanized updates released in 2020, collection of MachineGuid from HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid, service-disabling via HKLM\SYSTEM\CurrentControlSet\services[service_name]\Start=4, and command-and-control activity involving HTTP GET/POST with Base64-encoded traffic. The content also references the avsvmcloud[.]com domain as malicious infrastructure used in the SolarWinds compromise and later repurposed as a killswitch affecting SUNBURST infections still beaconing to that domain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
References include SolarWinds reporting such as 'SolarWinds SUNBURST attack explained' and reporting on APT29/NOBELIUM activity tied to the SolarWinds compromise.
The threat actor inserted malicious software into Solarwinds’ development environment, infecting Orion’s source code with the SUNBURST malware. The compromised build was pushed to customers as an update to their existing Orion installations, deploying SUNBURST into customer environments.
The threat actor inserted malicious software into Solarwinds’ development environment, infecting Orion’s source code with the SUNBURST malware. The compromised build was pushed to customers as an update to their existing Orion installations, deploying SUNBURST into customer environments.
the company's software by inserting the Sunburst malware into some updates for the SolarWinds Orion app
A second one is the Sunburst (Solorigate) backdoor malware deployed by the SolarWinds hackers on the systems of organizations who installed trojanized Orion builds via the platform's built-in automatic update mechanism.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Supply chain attacks are not common and the SolarWinds Supply-Chain Attack is one of the most potentially damaging attacks we’ve seen in recent memory.
In this case, they were actually deploying it through SolarWinds own distribution channels.
Use of malicious SolarWinds update : Inserting malicious code into legitimate software updates for the Orion software that allow an attacker remote access into the victim’s environment
State-sponsored threat actors have demonstrated their ability to compromise service providers such as MSPs as a method of infiltrating the supply chain of organizations of strategic interest, establishing persistence, and securing access to downstream targets.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
RedCurl mimicked legitimate file names and scheduled tasks, e.g. MicrosoftCurrentupdatesCheck and MdMMaintenenceTask to mask malicious files and scheduled tasks.
Bisonal has deleted Registry keys to clean up its prior activity ... FIN8 has deleted Registry keys during post compromise cleanup activities ... SUNBURST ... deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
CSPY Downloader has the ability to remove values it writes to the Registry.
SolarWinds has published limited information in which they state they believe the build environment was compromised.
This effectively prevents the use of malware sandboxes or other instrumented environments to detect it.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
This effectively prevents the use of malware sandboxes or other instrumented environments to detect it.
unless the machine is joined to a domain, the malware will not execute.
used by the SolarWinds hackers to communicate with systems compromised by the backdoored Orion product updates | a key domain name — avsvmcloud[.]com — that was used by the SolarWinds hackers to communicate with systems compromised by the backdoored Orion product updates
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
124 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor implanted into Trojanized SolarWinds Orion software updates that beaconed to attacker-controlled C2 infrastructure, enabled remote access, and could facilitate delivery of additional malware and data exfiltration.
Backdoor malware injected into trojanized SolarWinds Orion updates and distributed through signed software updates.
Backdoor inserted into SolarWinds Orion software updates to enable strategic espionage across government and enterprise networks.
Referenced in supporting material about the Solorigate intrusion chain; SUNBURST is a backdoor associated with the second-stage activation discussed in the cited material.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.