Loading story…
Mandiant reported that attackers used the SUNBURST backdoor in the SolarWinds supply chain compromise to gain covert access to victim environments and conduct highly evasive follow-on operations. The activity stemmed from trojanized SolarWinds Orion software updates, which allowed the threat actor to establish an initial foothold through trusted software and then selectively expand access inside targeted networks.
The intrusion set was notable for stealth and operational discipline, with attackers using the compromised Orion platform to blend into normal administrative activity and reduce the chance of detection. The case underscores the long-term impact of software supply chain compromises, where a single trusted update mechanism can provide broad downstream access and enable persistent espionage across multiple organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published technical analysis of the SUNBURST backdoor, detailing its 12-14 day execution delay, blacklist-based checks for security tools and drivers, registry changes to disable defenses, and WMI-based driver enumeration. The report also shared hunting indicators including a weaponized OrionImprovementBusinessLayer class, a named pipe, the Win32_SystemDriver query, and traffic to avsvmcloud[.]com subdomains.
CISA released Malware Analysis Report MAR-10320115-1.v1 covering TEARDROP, a malware family associated with the SolarWinds intrusion. The report added technical detail and indicators to support defender detection and analysis of follow-on malware used after the initial compromise.
CISA published alert AA21-008A with guidance for detecting threat activity in Microsoft cloud environments following compromise activity associated with the SolarWinds campaign. The alert expanded official response guidance beyond the initial supply-chain compromise to downstream cloud-focused post-exploitation detection.
CrowdStrike revealed SUNSPOT, a malware implant deployed in SolarWinds' development environment to replace legitimate Orion source code with malicious code that inserted the SUNBURST backdoor into builds. The disclosure added new technical detail about how the supply-chain compromise was carried out and highlighted the attackers' operational security measures to avoid detection.
CISA published an official page on the SolarWinds supply chain compromise, documenting the incident and providing government guidance and response information. This marks an earlier public U.S. government advisory related to the SUNBURST campaign.
Microsoft published a Microsoft 365 Defender hunting query focused on detecting Solorigate-related behavior involving launching cmd.exe with echo. The release provided defenders with campaign-specific detection guidance during the early public response to the SolarWinds compromise.
Security researchers and industry partners seized control of avsvmcloud[.]com, a command-and-control domain used by the SUNBURST malware in the SolarWinds compromise, and repurposed it as a killswitch. FireEye said the action could cause some new and existing SUNBURST infections to terminate, though it would not remove attackers that had already established other persistence.
Microsoft updated its attribution for the SolarWinds supply-chain compromise, renaming the actor from the malware-centric label 'Solorigate' to NOBELIUM and linking it to the SUNBURST backdoor, TEARDROP malware, and related activity. The company also said it had released detections on December 13 and would begin blocking known malicious SolarWinds binaries with Microsoft Defender Antivirus on December 16 while urging customers to treat affected Orion systems as compromised.
Symantec published a threat-intelligence blog on the SUNBURST supply-chain attack targeting SolarWinds users. The post marks an early public security-industry analysis of the campaign shortly after its disclosure.
Mandiant published a blog post analyzing how an evasive attacker leveraged the SolarWinds supply chain compromise using the SUNBURST backdoor. No earlier event details are provided in the reference content, so the publication itself is the only extractable timeline event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
otx.alienvault.com
Open sourceotx.alienvault.com
Open sourcemandiant.com
Open sourcesentinelone.com
Open sourcegithub.com
Open sourcekrebsonsecurity.com
Open sourcemicrosoft.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Jun 29, 2026
Investigations into SolarWinds-related compromises have highlighted two distinct but high-impact intrusion paths: the **SUNBURST** supply-chain compromise affecting SolarWinds Orion customers and a later **path traversal** flaw in SolarWinds Serv-U tracked as `CVE-2024-28995`. Fidelis reported on incident response and forensic analysis tied to the Orion compromise, where attackers leveraged trojanized software updates to gain footholds in victim environments, while Censys documented internet-exposed Serv-U systems affected by the traversal vulnerability and the resulting urgency around patching and exposure reduction. Threat reporting has also linked SolarWinds activity to broader nation-state tradecraft. Dragos has tracked **ALLANITE**, an activity group associated with espionage against critical infrastructure, in the wider context of campaigns involving trusted third-party relationships and stealthy post-compromise operations. Together, the reporting shows SolarWinds remaining a recurring focal point for defenders, both as a victim of supply-chain abuse and as a vendor whose products have presented exploitable attack surface requiring rapid mitigation.
Jul 12, 2026
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked **OilRig** tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to `srvr.js`, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that **Turla** had previously hijacked OilRig infrastructure. A separate assessment of the **SolarWinds Orion** breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including **DHS**, **FireEye**, and the **U.S. Treasury**, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and **Cobalt Strike** deployment.
Jun 29, 2026