Loading story…
Investigations into SolarWinds-related compromises have highlighted two distinct but high-impact intrusion paths: the SUNBURST supply-chain compromise affecting SolarWinds Orion customers and a later path traversal flaw in SolarWinds Serv-U tracked as CVE-2024-28995. Fidelis reported on incident response and forensic analysis tied to the Orion compromise, where attackers leveraged trojanized software updates to gain footholds in victim environments, while Censys documented internet-exposed Serv-U systems affected by the traversal vulnerability and the resulting urgency around patching and exposure reduction.
Threat reporting has also linked SolarWinds activity to broader nation-state tradecraft. Dragos has tracked ALLANITE, an activity group associated with espionage against critical infrastructure, in the wider context of campaigns involving trusted third-party relationships and stealthy post-compromise operations. Together, the reporting shows SolarWinds remaining a recurring focal point for defenders, both as a victim of supply-chain abuse and as a vendor whose products have presented exploitable attack surface requiring rapid mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SolarWinds published an advisory for a path traversal vulnerability in Serv-U, tracked as CVE-2024-28995. The advisory date is explicitly referenced as July 17, 2024.
Fidelis Security published analysis of the SolarWinds attack, describing the ongoing investigation, impact, and response to the Orion supply-chain compromise. This reflects the public disclosure and active incident-response phase surrounding the campaign.
Dragos published a profile on ALLANITE, documenting the threat actor and its activity. The reference indicates public attribution and technical characterization of the group.
3 references tracked. Mallory keeps watching after this page renders.
dragos.com
Open sourcecensys.com
Open sourcefidelissecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Jun 29, 2026
Mandiant reported that attackers used the **SUNBURST** backdoor in the SolarWinds supply chain compromise to gain covert access to victim environments and conduct highly evasive follow-on operations. The activity stemmed from trojanized SolarWinds Orion software updates, which allowed the threat actor to establish an initial foothold through trusted software and then selectively expand access inside targeted networks. The intrusion set was notable for stealth and operational discipline, with attackers using the compromised Orion platform to blend into normal administrative activity and reduce the chance of detection. The case underscores the long-term impact of software supply chain compromises, where a single trusted update mechanism can provide broad downstream access and enable persistent espionage across multiple organizations.
Jun 29, 2026
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked **OilRig** tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to `srvr.js`, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that **Turla** had previously hijacked OilRig infrastructure. A separate assessment of the **SolarWinds Orion** breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including **DHS**, **FireEye**, and the **U.S. Treasury**, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and **Cobalt Strike** deployment.
Jun 29, 2026