Loading story…
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked OilRig tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to srvr.js, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that Turla had previously hijacked OilRig infrastructure.
A separate assessment of the SolarWinds Orion breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including DHS, FireEye, and the U.S. Treasury, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and Cobalt Strike deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
According to the SolarWinds writeup, attackers digitally signed and distributed trojanized Orion updates from the official SolarWinds update server between March and May 2020. The affected organizations named in the article include DHS, FireEye, and the U.S. Treasury.
The SolarWinds analysis states that update server credentials were accidentally exposed on GitHub in 2019. The writeup presents this as a plausible initial access path to the company's update infrastructure.
A researcher published an analysis describing a directory traversal flaw in OilRig's Poison Frog/Glimpse C2 server that could enable arbitrary file write and remote code execution by modifying srvr.js and forcing a restart. The article argues this weakness may help explain prior reporting that Turla had hijacked OilRig infrastructure.
A leaked source-code dump allegedly tied to OilRig in 2019 exposed the server-side Node.js code for the Poison Frog/Glimpse command-and-control infrastructure. The later analysis says this leak revealed insecure trust of agent-supplied input in file upload handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations into SolarWinds-related compromises have highlighted two distinct but high-impact intrusion paths: the **SUNBURST** supply-chain compromise affecting SolarWinds Orion customers and a later **path traversal** flaw in SolarWinds Serv-U tracked as `CVE-2024-28995`. Fidelis reported on incident response and forensic analysis tied to the Orion compromise, where attackers leveraged trojanized software updates to gain footholds in victim environments, while Censys documented internet-exposed Serv-U systems affected by the traversal vulnerability and the resulting urgency around patching and exposure reduction. Threat reporting has also linked SolarWinds activity to broader nation-state tradecraft. Dragos has tracked **ALLANITE**, an activity group associated with espionage against critical infrastructure, in the wider context of campaigns involving trusted third-party relationships and stealthy post-compromise operations. Together, the reporting shows SolarWinds remaining a recurring focal point for defenders, both as a victim of supply-chain abuse and as a vendor whose products have presented exploitable attack surface requiring rapid mitigation.
Jul 12, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Jun 29, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026