Loading malware…
SUNSPOT is a custom Windows implant used in the SolarWinds Orion supply-chain compromise to tamper with the software build process and insert the SUNBURST backdoor into Orion builds. It is associated with APT29, also tracked as NOBELIUM, UNC2452, Dark Halo, and Cozy Bear, and was used during the 2020 intrusion into SolarWinds’ build environment.
The malware was designed specifically for build-server compromise and operated by monitoring running processes for the Orion build workflow, including detection of MsBuild.exe and extraction of command-line context to identify the targeted Orion solution path. When the expected build conditions were met, SUNSPOT replaced a legitimate Orion source file with a malicious variant containing SUNBURST, allowing the backdoor to be compiled into signed Orion software updates. To reduce the chance of discovery, it created a backup of the original source file, staged the malicious replacement as a temporary file, moved it into place for compilation, then restored the legitimate source after the build completed and deleted temporary artifacts.
SUNSPOT incorporated multiple operational-security and evasion measures. It stored the malicious SUNBURST source and target path information in AES-128-CBC encrypted blobs, used Windows API functions during the file-replacement workflow, maintained persistence through a scheduled task, and masqueraded as a benign Windows-related process name on disk. It also generated a local encrypted log artifact. Its behavior reflects a narrowly tailored objective: covert manipulation of stored source code on a compromised build server rather than broad victim-side functionality.
SUNSPOT is notable as a purpose-built supply-chain implant focused on software production environments. Its role was not mass deployment to downstream victims, but covert pre-compilation source-code substitution inside SolarWinds’ development pipeline, enabling subsequent distribution of trojanized Orion updates to a large customer base.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Details of the SolarWinds software compromise SUNSPOT malware can be found in the CrowdStrike report ... Deploy malware on build server, set mutexes and log files locally. Monitor for the build process to start ... replace the target code files with malicious code files. Once build is complete, replace malicious code files with legitimate code from the backups created. | This detection logic was chosen to allow for the potential detection of other threat actors attempting to perform any similar attack, rather than just a detection of the specific SUNSPOT malware.
Nobelium had managed to compromise the SolarWinds software build environment and used a custom implant called SUNSPOT to load the SUNBURST backdoor into the Orion software update.
In a blog post late last night, the infosec firm said the Orion-targeting malware, which it codenamed Sunspot, had "several safeguards" to ensure its deployment of compromised code into new Orion builds didn't trigger SolarWinds' suspicions.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
after the threat actor gained access to their production systems they successfully trojanised SolarWinds Orion’s software updates to distribute malware consisting of backdoor code embedded in a legitimate SolarWinds software library
As part of the attack, the hackers gained access to the SolarWinds Orion build system and injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software. This DLL was later automatically distributed to SolarWinds customers in a supply chain attack.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
let build_processes = dynamic ( [ "MSBuild.exe" , "dontnet.exe" , "VBCSCompiler.exe" ] )
SUNSPOT monitors and hijacks processes involved in the compilation of code and replaces one of the source files with a malicious source file containing the SUNBURST backdoor.
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Akira has used legitimate names and locations for files to evade defenses.
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
Once build is complete, replace malicious code files with legitimate code from the backups created.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
let build_processes = dynamic ( [ "MSBuild.exe" , "dontnet.exe" , "VBCSCompiler.exe" ] )
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
SUNSPOT monitors and hijacks processes involved in the compilation of code and replaces one of the source files with a malicious source file containing the SUNBURST backdoor.
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Their toolkit includes ... SUNBURST, SUNSPOT, SUPERNOVA, TEARDROP...
A custom implant used in the SolarWinds compromise to insert the SUNBURST backdoor into Orion software builds.
Build-system malware used to insert the SUNBURST backdoor into SolarWinds Orion software builds by hijacking compilation processes and swapping in malicious source code while avoiding build failures.
Implant referenced in citation material.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.