Loading malware…
SUNBURST, also known as Solorigate, is a sophisticated Windows backdoor embedded in digitally signed updates for the SolarWinds Orion enterprise IT-management platform during the 2020 SolarWinds software supply-chain compromise. Organizations that installed the trojanized updates deployed the backdoor on Orion servers, enabling operators to identify selected victims and conduct targeted follow-on intrusion activity. The campaign is associated with UNC2452, also tracked as Dark Halo, and was assessed by U.S. authorities as a Russian-origin intelligence-gathering operation.
SUNBURST delays execution, profiles compromised hosts, and uses checks for security products and analysis environments to reduce detection. It collects host, operating-system, user, uptime, process, service, driver, and network-configuration information. Process and service information is compared against obfuscated blocklists, and the malware can disable selected services. Its command set supports file and directory enumeration, file deletion, registry modification, service manipulation, system rebooting, execution of payloads through VBScript and Rundll32, and delivery of follow-on tooling including TEARDROP in observed intrusions.
For command and control, SUNBURST uses HTTP requests and DNS communications designed to resemble normal SolarWinds Orion Improvement Program activity. It applies Base64 encoding, single-byte XOR encryption, compression, junk data, and benign-looking structured formats to obscure traffic and collected data. It can remove registry, proxy, firewall, and other artifacts created during its operation. The supply-chain campaign affected government and private-sector Orion customers globally, including organizations in technology, telecommunications, manufacturing, healthcare, finance, retail, education, and government sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro's Zero-Day Initiative (ZDI) provided technical analysis of recently patched vulnerabilities in the SolarWinds Orion Platform. CVE-2020-14005, one of these vulnerabilities, has been linked to the recent SUNBURST cyberattack on SolarWinds. These vulnerabilities, when combined, could allow an unauthenticated attacker to execute arbitrary code as Administrator on an affected system. | The attackers used the access provided by this application to plant a backdoor known as Sunburst onto affected machines.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“This attack code, called SUNBURST by security researchers, notified the threat actors that it had been installed each time a company performed its Orion updates.”
This was executed by trojanizing SolarWinds Orion business software updates that inserted a vulnerability (SUNBURST) within their Orion Platform software builds...
...18,000 of its 300,000 customers downloaded a version of its Orion software that was tainted with the Sunburst malware, the attackers activated the malware only on a handful of customers networks.
The malicious builds were later used to deliver a backdoor tracked as Sunburst to "fewer than 18,000," but, luckily, the threat actors only picked a substantially lower number of targets for second-stage exploitation.
Kaspersky also made a connection between the Russian Turla hacking group and the SolarWinds hackers after finding feature overlaps between the Sunburst backdoor and the Kazuar backdoor linked to Turla in the past.
Once installed, SUNBURST would sleep for 12-14 days before it contacted the group’s C&C domain via DNS.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
RunTask ... ProcessStartInfo(fileName, arguments) ... if (process.Start())
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
“SUNBURST also installed additional code which permitted the threat actors to remotely access the Orion system at any time, while still hiding itself to avoid being detected.”
The malware disguises its network traffic as the Orion Improvement Program (OIP) protocol
The threat actor operates with high operational security, obfuscating the command and control mechanisms and making use of anti-forensics techniques.
private enum JobEngine { ... DeleteFile, ... } | DeleteFile ... File.Delete(Environment.ExpandEnvironmentVariables(args[0]));
The backdoors use multiple obfuscated block lists to identify forensic and antivirus tools running as processes, services, and drivers.
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
private enum JobEngine { ... RunTask, GetProcessByDescription, KillTask, ... } | GetProcessByDescription ... foreach (Process process in Process.GetProcesses()) ... Select * From Win32_Process
which include the ability to transfer files, run files, profile the system
private enum JobEngine { ... GetFileSystemEntries ... } | private enum JobEngine { ... GetFileSystemEntries, WriteFile, FileExists, DeleteFile, GetFileHash, ... } | GetFileSystemEntries ... Directory.GetFiles(path, searchPattern) ... Directory.GetDirectories(path, searchPattern)
includes a backdoor that communicates to a third-party servers using HTTP
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
CryptoHelper builds domain strings with GetStatus(); GetPreviousString/GetNextString append encoded data to subdomains, and DnsHelper.GetIPHostEntry(hostName) resolves them. | DnsHelper.GetAddressFamily(hostName, dnsRecords) ... Dns.GetHostEntry(hostName) ... hostName = cryptoHelper.GetCurrentString()/GetNextString...
this.proxy = HttpProxySettings.Instance.AsWebProxy(); ... this.proxy = WebRequest.GetSystemWebProxy();
1,938 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in the SolarWinds compromise, featuring DNS-based command-and-control beaconing and DGA-style subdomain activity discussed here through log analysis and detection gaps.
Backdoor implanted into SolarWinds Orion via a compromised build pipeline and distributed through legitimate software updates as part of a supply-chain attack.
A backdoor implanted into Trojanized SolarWinds Orion software updates that beaconed to attacker-controlled C2 infrastructure, enabled remote access, and could facilitate delivery of additional malware and data exfiltration.
Backdoor malware injected into trojanized SolarWinds Orion updates and distributed through signed software updates.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.