Loading story…
Volexity reported that the threat actor it tracks as Dark Halo used the compromised SolarWinds Orion platform to breach multiple organizations, including a US-based think tank, in activity overlapping with FireEye’s UNC2452 reporting. In one intrusion tied to July 2020, the actor’s apparent objective was to steal email from selected executives, policy experts, and IT staff. Investigators said the attackers relied heavily on legitimate Microsoft Exchange administration features, including ActiveSync manipulation, mailbox export requests, and exfiltration staged through Outlook Web App infrastructure, while minimizing malware use and removing evidence where possible.
Volexity also described a separate incident in which Dark Halo bypassed Duo-protected MFA for Outlook Web App after obtaining the Duo integration secret key from the compromised OWA server and forging a valid duo-sid cookie. The firm said the technique did not reflect a vulnerability in Duo’s product, but rather abuse made possible by prior server compromise. The report characterized the actor as highly sophisticated, using living-off-the-land methods, selective malware deployment, and command-and-control infrastructure overlapping with the broader SolarWinds campaign, with volatile evidence loss preventing full reconstruction of the initial access path in one case.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Volexity publicly reported that Dark Halo was tied to multiple intrusions, including the July 2020 think tank breach likely enabled by the SolarWinds compromise. The report also detailed the actor's stealthy tradecraft, selective malware use, evidence cleanup, and overlapping infrastructure with the broader SolarWinds campaign.
In a separate intrusion disclosed by Volexity, Dark Halo bypassed Duo-protected multi-factor authentication for Outlook Web App by obtaining the Duo integration secret key from the compromised OWA server and forging a valid duo-sid cookie. Volexity emphasized this was not a vulnerability in Duo itself, but a consequence of prior server compromise.
In July 2020, a threat actor tracked by Volexity as Dark Halo compromised a US-based think tank through the trojanized SolarWinds Orion platform. Volexity linked this intrusion to activity overlapping with FireEye's UNC2452 reporting.
Following the intrusion, Dark Halo focused on collecting email from selected executives, policy experts, and IT staff. The actor used Exchange administrative tools, ActiveSync manipulation, mailbox export requests, and staged exfiltration through Outlook Web App infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 68 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds disclosed that the **SUNBURST** compromise of its Orion platform led to actual follow-on intrusions at fewer than 100 customers, despite roughly 18,000 organizations downloading tainted updates. Investigators said the attackers, widely attributed by the U.S. government to Russia’s **SVR** and tracked as **NOBELIUM/UNC2452/Dark Halo**, inserted a backdoor into signed Orion updates and used delayed activation, DNS-based victim profiling, and selective second-stage deployment to focus on high-value targets. Victims included U.S. government agencies and private-sector organizations, while related activity also reached Mimecast, where the same actor accessed encrypted customer service account credentials and compromised certain authentication certificates affecting a small number of Microsoft 365 tenants. Incident response findings showed the campaign extended well beyond the initial Orion malware, with attackers stealing email, moving laterally through on-premises networks, bypassing MFA in some cases, forging SAML tokens, and abusing Azure AD and Microsoft 365 to access cloud resources. Research from Volexity, Symantec, Microsoft, and others detailed command-and-control through `avsvmcloud[.]com`, HTTP-based second-stage operations, mailbox theft, and stealthy use of legitimate identity infrastructure. In response, **CISA** issued an emergency directive, released the **CHIRP** detection tool, and published eviction guidance warning that full remediation may require rebuilding identity systems, rotating credentials, and isolating affected networks to remove long-term adversary access.
Aug 15, 2026
CISA and multiple security firms reported intrusions in which attackers deployed the **SUPERNOVA** web shell and other backdoored components on **SolarWinds Orion** servers to steal credentials and maintain covert access. In one CISA-tracked case, the adversary accessed the victim through VPN using valid accounts and U.S.-based residential IP addresses, moved laterally with obfuscated PowerShell, reached the Orion server, dumped **LSASS** credentials, and exfiltrated stolen data through the organization’s web server. Investigators said log clearing prevented confirmation of whether initial access involved exploitation of `CVE-2020-10148`, and the attackers repeatedly deleted evidence to hinder response. Separate incident reporting from Sophos described a similar Orion compromise in which attackers replaced `OrionWeb.dll` with a malicious unsigned version that harvested SolarWinds and LDAP credentials, created a hidden `_system` login protected by a dynamic daily password, and erased audit traces of that access. The actor also used a public-facing web shell, abused **WMIC** for remote execution, and attempted to dump Active Directory data, while post-compromise activity included masquerading tools such as `procdump.exe` and `winrar.exe` as `wininit.exe`. Splunk, Microsoft, and community defenders published detections focused on process creation telemetry such as **Event ID 4688**, suspicious Orion file changes, known SUPERNOVA hashes, and anomalous SolarWinds-related network and process activity.
Aug 15, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Aug 21, 2026