SolarWinds Intrusions Span Orion Supply Chain Abuse and Serv-U Path Traversal

Investigations into SolarWinds-related compromises have highlighted two distinct but high-impact intrusion paths: the SUNBURST supply-chain compromise affecting SolarWinds Orion customers and a later path traversal flaw in SolarWinds Serv-U tracked as CVE-2024-28995. Fidelis reported on incident response and forensic analysis tied to the Orion compromise, where attackers leveraged trojanized software updates to gain footholds in victim environments, while Censys documented internet-exposed Serv-U systems affected by the traversal vulnerability and the resulting urgency around patching and exposure reduction.

Threat reporting has also linked SolarWinds activity to broader nation-state tradecraft. Dragos has tracked ALLANITE, an activity group associated with espionage against critical infrastructure, in the wider context of campaigns involving trusted third-party relationships and stealthy post-compromise operations. Together, the reporting shows SolarWinds remaining a recurring focal point for defenders, both as a victim of supply-chain abuse and as a vendor whose products have presented exploitable attack surface requiring rapid mitigation.