vendor-distribution-compromisestate-sponsored-espionageremote-access-implantpersistence-method

SUNBURST Backdoor Enabled Evasive Intrusions in SolarWinds Supply Chain Attack

Supply Chain Risk · 12 sources · Updated 4mo ago · First seen May 25, 2026

Mandiant reported that attackers used the SUNBURST backdoor in the SolarWinds supply chain compromise to gain covert access to victim environments and conduct highly evasive follow-on operations. The activity stemmed from trojanized SolarWinds Orion software updates, which allowed the threat actor to establish an initial foothold through trusted software and then selectively expand access inside targeted networks.

The intrusion set was notable for stealth and operational discipline, with attackers using the compromised Orion platform to blend into normal administrative activity and reduce the chance of detection. The case underscores the long-term impact of software supply chain compromises, where a single trusted update mechanism can provide broad downstream access and enable persistent espionage across multiple organizations.

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

10 events · Dec 13, 2020 – Sep 2, 2021

Sep 2, 20215y ago
SentinelLabs publishes SUNBURST execution and hunting indicator analysis
SentinelLabs published technical analysis of the SUNBURST backdoor, detailing its 12-14 day execution delay, blacklist-based checks for security tools and drivers, registry changes to disable defenses, and WMI-based driver enumeration. The report also shared hunting indicators including a weaponized OrionImprovementBusinessLayer class, a named pipe, the Win32_SystemDriver query, and traffic to avsvmcloud[.]com subdomains.
SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabs
Apr 15, 20216y ago
CISA publishes malware analysis report on TEARDROP
CISA released Malware Analysis Report MAR-10320115-1.v1 covering TEARDROP, a malware family associated with the SolarWinds intrusion. The report added technical detail and indicators to support defender detection and analysis of follow-on malware used after the initial compromise.
MAR-10320115-1.v1 - TEARDROP | CISA
Apr 15, 20216y ago
CISA issues alert on post-compromise activity in Microsoft cloud environments
CISA published alert AA21-008A with guidance for detecting threat activity in Microsoft cloud environments following compromise activity associated with the SolarWinds campaign. The alert expanded official response guidance beyond the initial supply-chain compromise to downstream cloud-focused post-exploitation detection.
Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments | CISA
Jan 12, 20216y ago
CrowdStrike discloses SUNSPOT malware used in SolarWinds build tampering
CrowdStrike revealed SUNSPOT, a malware implant deployed in SolarWinds' development environment to replace legitimate Orion source code with malicious code that inserted the SUNBURST backdoor into builds. The disclosure added new technical detail about how the supply-chain compromise was carried out and highlighted the attackers' operational security measures to avoid detection.
New Sunspot malware found while investigating SolarWinds hack
Jan 7, 20216y ago
CISA publishes SolarWinds supply chain compromise advisory
CISA published an official page on the SolarWinds supply chain compromise, documenting the incident and providing government guidance and response information. This marks an earlier public U.S. government advisory related to the SUNBURST campaign.
Supply Chain Compromise | CISA
Dec 18, 20206y ago
Microsoft publishes Solorigate Defender hunting query
Microsoft published a Microsoft 365 Defender hunting query focused on detecting Solorigate-related behavior involving launching cmd.exe with echo. The release provided defenders with campaign-specific detection guidance during the early public response to the SolarWinds compromise.
Microsoft-365-Defender-Hunting-Queries/Campaigns/launching-cmd-echo[Solorigate].md at 3cb633cee8332b5eb968b4ae1947b9ddb7a5958f · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHub
Dec 16, 20206y ago
FireEye, Microsoft, and GoDaddy turn SUNBURST C2 domain into killswitch
Security researchers and industry partners seized control of avsvmcloud[.]com, a command-and-control domain used by the SUNBURST malware in the SolarWinds compromise, and repurposed it as a killswitch. FireEye said the action could cause some new and existing SUNBURST infections to terminate, though it would not remove attackers that had already established other persistence.
Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’ - Krebs on Security
Dec 15, 20206y ago
Microsoft attributes SolarWinds campaign to NOBELIUM
Microsoft updated its attribution for the SolarWinds supply-chain compromise, renaming the actor from the malware-centric label 'Solorigate' to NOBELIUM and linking it to the SUNBURST backdoor, TEARDROP malware, and related activity. The company also said it had released detections on December 13 and would begin blocking known malicious SolarWinds binaries with Microsoft Defender Antivirus on December 16 while urging customers to treat affected Orion systems as compromised.
Ensuring customers are protected from Solorigate | Microsoft Security Blog
Dec 14, 20206y ago
Symantec publishes analysis of SUNBURST SolarWinds supply-chain attack
Symantec published a threat-intelligence blog on the SUNBURST supply-chain attack targeting SolarWinds users. The post marks an early public security-industry analysis of the campaign shortly after its disclosure.
Sunburst: Supply Chain Attack Targets SolarWinds Users | SECURITY.COM
Dec 13, 20206y ago
Mandiant publishes analysis of SUNBURST in SolarWinds supply chain attack
Mandiant published a blog post analyzing how an evasive attacker leveraged the SolarWinds supply chain compromise using the SUNBURST backdoor. No earlier event details are provided in the reference content, so the publication itself is the only extractable timeline event.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

SUNBURST

Affected products

1 linked

Orion Platform

Organizations

1 linked

SolarWinds

Breaches

1 linked

SOLARWINDS-2020-03

Observables

1 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

12 references tracked. Mallory keeps watching after this page renders.

Otx AlienvaultNews · Jan 1, 2026

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor - LevelBlue - Open Threat ExchangeOpen source ↗

Otx AlienvaultNews · Jan 1, 2026

Sunburst: Supply Chain Attack Targets SolarWinds Users - LevelBlue - Open Threat ExchangeOpen source ↗

Mandiant BlogAdvisories · Mar 25, 2024

SolarWinds Supply Chain Attack Uses SUNBURST Backdoor | Google Cloud BlogOpen source ↗

Sentinelone LabsNews · Sep 2, 2021

SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabsOpen source ↗

4 additional sources from 07-01-2021 to 15-04-2021

Github WebNews · Dec 18, 2020

Microsoft-365-Defender-Hunting-Queries/Campaigns/launching-cmd-echo[Solorigate].md at 3cb633cee8332b5eb968b4ae1947b9ddb7a5958f · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHubOpen source ↗

Krebs On SecurityNews · Dec 16, 2020

Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’ - Krebs on SecurityOpen source ↗

Microsoft GeneralAdvisories · Dec 15, 2020

Ensuring customers are protected from Solorigate | Microsoft Security BlogOpen source ↗

Symantec Enterprise BlogsNews · Dec 14, 2020

Sunburst: Supply Chain Attack Targets SolarWinds Users | SECURITY.COMOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

vendor-distribution-compromisestate-sponsored-espionageremote-access-implantpersistence-method

SUNBURST Backdoor Enabled Evasive Intrusions in SolarWinds Supply Chain Attack

Supply Chain Risk · 12 sources · Updated 4mo ago · First seen May 25, 2026

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

10 events · Dec 13, 2020 – Sep 2, 2021

Sep 2, 20215y ago
SentinelLabs publishes SUNBURST execution and hunting indicator analysis
SentinelLabs published technical analysis of the SUNBURST backdoor, detailing its 12-14 day execution delay, blacklist-based checks for security tools and drivers, registry changes to disable defenses, and WMI-based driver enumeration. The report also shared hunting indicators including a weaponized OrionImprovementBusinessLayer class, a named pipe, the Win32_SystemDriver query, and traffic to avsvmcloud[.]com subdomains.
SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabs
Apr 15, 20216y ago
CISA publishes malware analysis report on TEARDROP
CISA released Malware Analysis Report MAR-10320115-1.v1 covering TEARDROP, a malware family associated with the SolarWinds intrusion. The report added technical detail and indicators to support defender detection and analysis of follow-on malware used after the initial compromise.
MAR-10320115-1.v1 - TEARDROP | CISA
Apr 15, 20216y ago
CISA issues alert on post-compromise activity in Microsoft cloud environments
CISA published alert AA21-008A with guidance for detecting threat activity in Microsoft cloud environments following compromise activity associated with the SolarWinds campaign. The alert expanded official response guidance beyond the initial supply-chain compromise to downstream cloud-focused post-exploitation detection.
Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments | CISA
Jan 12, 20216y ago
CrowdStrike discloses SUNSPOT malware used in SolarWinds build tampering
CrowdStrike revealed SUNSPOT, a malware implant deployed in SolarWinds' development environment to replace legitimate Orion source code with malicious code that inserted the SUNBURST backdoor into builds. The disclosure added new technical detail about how the supply-chain compromise was carried out and highlighted the attackers' operational security measures to avoid detection.
New Sunspot malware found while investigating SolarWinds hack
Jan 7, 20216y ago
CISA publishes SolarWinds supply chain compromise advisory
CISA published an official page on the SolarWinds supply chain compromise, documenting the incident and providing government guidance and response information. This marks an earlier public U.S. government advisory related to the SUNBURST campaign.
Supply Chain Compromise | CISA
Dec 18, 20206y ago
Microsoft publishes Solorigate Defender hunting query
Microsoft published a Microsoft 365 Defender hunting query focused on detecting Solorigate-related behavior involving launching cmd.exe with echo. The release provided defenders with campaign-specific detection guidance during the early public response to the SolarWinds compromise.
Microsoft-365-Defender-Hunting-Queries/Campaigns/launching-cmd-echo[Solorigate].md at 3cb633cee8332b5eb968b4ae1947b9ddb7a5958f · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHub
Dec 16, 20206y ago
FireEye, Microsoft, and GoDaddy turn SUNBURST C2 domain into killswitch
Security researchers and industry partners seized control of avsvmcloud[.]com, a command-and-control domain used by the SUNBURST malware in the SolarWinds compromise, and repurposed it as a killswitch. FireEye said the action could cause some new and existing SUNBURST infections to terminate, though it would not remove attackers that had already established other persistence.
Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’ - Krebs on Security
Dec 15, 20206y ago
Microsoft attributes SolarWinds campaign to NOBELIUM
Microsoft updated its attribution for the SolarWinds supply-chain compromise, renaming the actor from the malware-centric label 'Solorigate' to NOBELIUM and linking it to the SUNBURST backdoor, TEARDROP malware, and related activity. The company also said it had released detections on December 13 and would begin blocking known malicious SolarWinds binaries with Microsoft Defender Antivirus on December 16 while urging customers to treat affected Orion systems as compromised.
Ensuring customers are protected from Solorigate | Microsoft Security Blog
Dec 14, 20206y ago
Symantec publishes analysis of SUNBURST SolarWinds supply-chain attack
Symantec published a threat-intelligence blog on the SUNBURST supply-chain attack targeting SolarWinds users. The post marks an early public security-industry analysis of the campaign shortly after its disclosure.
Sunburst: Supply Chain Attack Targets SolarWinds Users | SECURITY.COM
Dec 13, 20206y ago
Mandiant publishes analysis of SUNBURST in SolarWinds supply chain attack
Mandiant published a blog post analyzing how an evasive attacker leveraged the SolarWinds supply chain compromise using the SUNBURST backdoor. No earlier event details are provided in the reference content, so the publication itself is the only extractable timeline event.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →