Loading malware…
SUNSPOT is a Windows malware implant used to compromise the SolarWinds Orion software build process during the 2020 SolarWinds supply-chain intrusion. Associated with APT29, also tracked as NOBELIUM and attributed to Russia’s Foreign Intelligence Service, it inserted the SUNBURST backdoor into Orion builds that were subsequently distributed through legitimate software updates. SUNSPOT operated within the compromised build environment rather than serving as the backdoor installed on downstream customer systems.
SUNSPOT monitored running processes, identifying Microsoft MSBuild instances by hashing process names and inspecting command-line arguments to locate targeted Orion builds. It decrypted embedded SUNBURST source code from AES-128-CBC-encrypted blobs, backed up a legitimate source file, and temporarily replaced it with malicious source code for compilation. After the build completed, it restored the original source and deleted temporary backup artifacts to conceal the modification. It used native Windows APIs for process inspection and file replacement, maintained encrypted local logs, and masqueraded as a legitimate system component. A scheduled task configured by the attackers maintained its persistence at host startup.
Its immediate target was SolarWinds’ software development and build infrastructure. By compromising the integrity of Orion releases, SUNSPOT enabled downstream initial access in an espionage campaign affecting government and commercial organizations, including technology, consulting, and telecommunications sectors.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion.
Nobelium had managed to compromise the SolarWinds software build environment and used a custom implant called SUNSPOT to load the SUNBURST backdoor into the Orion software update.
In a blog post late last night, the infosec firm said the Orion-targeting malware, which it codenamed Sunspot, had "several safeguards" to ensure its deployment of compromised code into new Orion builds didn't trigger SolarWinds' suspicions.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
after the threat actor gained access to their production systems they successfully trojanised SolarWinds Orion’s software updates to distribute malware consisting of backdoor code embedded in a legitimate SolarWinds software library
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
SUNSPOT monitors and hijacks processes involved in the compilation of code and replaces one of the source files with a malicious source file containing the SUNBURST backdoor.
They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
replaces one of the source files with a malicious source file containing the SUNBURST backdoor
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
SUNSPOT monitors and hijacks processes involved in the compilation of code and replaces one of the source files with a malicious source file containing the SUNBURST backdoor.
They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.