SUNSPOT
SUNSPOT is a Windows malware implant used in the SolarWinds Orion supply-chain compromise to tamper with the Orion build environment and inject the SUNBURST backdoor into Orion software builds. It was discovered and named by CrowdStrike, which reported that the malware was dropped into SolarWinds’ development environment and monitored the build server for Orion build activity, including MsBuild.exe running the Orion solution. When triggered, SUNSPOT replaced legitimate Orion source code files with a malicious backdoored version during compilation, then restored the original file after the build completed to reduce the chance of detection. The malware included safeguards and operational security measures intended to remain undetected in the build environment, including only replacing source code when hardcoded MD5 checksums of both the original and replacement files matched expected values. Content also states that the malicious SUNBURST source code and target file paths were stored in AES128-CBC encrypted blobs protected with the same key and IV. SUNSPOT used Windows API functions including MoveFileEx and NtQueryInformationProcess as part of the injection process, modified its security token to add SeDebugPrivilege, and was maintained via a scheduled task that persisted across host boot. It was identified on disk as taskhostsvc.exe and created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log. The malware is associated with the SolarWinds compromise and is attributed in the provided content to APT29/UNC2452/Dark Halo/StellarParticle, a Russian-linked espionage actor, though some reporting also noted possible Turla-related overlaps. Its purpose was specifically to insert SUNBURST into signed SolarWinds Orion updates that were then distributed through the legitimate update mechanism to downstream victims, including governments and enterprises.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In a blog post late last night, the infosec firm said the Orion-targeting malware, which it codenamed Sunspot, had "several safeguards" to ensure its deployment of compromised code into new Orion builds didn't trigger SolarWinds' suspicions.
Sunspot, as it was dubbed by CrowdStrike, was dropped by the attackers in the development environment of SolarWinds' Orion IT management software. After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code.
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueFor the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.
Initial Access
3 techniquesAPT29 employed a range of techniques for initial compromise, including spearphishing emails... Additionally, the group exploited vulnerabilities in public-facing infrastructure... APT29 also used supply chain compromise.
As part of the attack, the hackers gained access to the SolarWinds Orion build system and injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software. This DLL was later automatically distributed to SolarWinds customers in a supply chain attack.
During the 3CX Supply Chain Attack, AppleJeus first compromised an "end-of-life" trading software application which was downloaded and executed inside the 3CX enterprise environment. The second compromise modified the Windows and macOS build environments used to distribute the 3CX software to their customer base.
Execution
6 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
Persistence
2 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Privilege Escalation
3 techniques“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Stealth
11 techniquesThe content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
Discovery
2 techniquesThe content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
Sunspot detected “the Orion solution file path in a running MsBuild.exe process” before replacing a source code file in the solution directory.
Impact
1 techniqueRecent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Their toolkit includes ... SUNBURST, SUNSPOT, SUPERNOVA, TEARDROP...
APT29 malware used in the SolarWinds compromise, including for persistence via a scheduled task at host boot.
Malware implanted in the SolarWinds build environment to monitor the build process and covertly replace legitimate source code with malicious code that inserted the Sunburst backdoor into Orion builds.
Sunspot is malware used inside the SolarWinds Orion build environment to monitor the build process, replace a source code file with a malicious variant during compilation, inject SUNBURST into Orion builds, and then restore the original file to avoid detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.