Loading story…
CISA and multiple security firms reported intrusions in which attackers deployed the SUPERNOVA web shell and other backdoored components on SolarWinds Orion servers to steal credentials and maintain covert access. In one CISA-tracked case, the adversary accessed the victim through VPN using valid accounts and U.S.-based residential IP addresses, moved laterally with obfuscated PowerShell, reached the Orion server, dumped LSASS credentials, and exfiltrated stolen data through the organization’s web server. Investigators said log clearing prevented confirmation of whether initial access involved exploitation of CVE-2020-10148, and the attackers repeatedly deleted evidence to hinder response.
Separate incident reporting from Sophos described a similar Orion compromise in which attackers replaced OrionWeb.dll with a malicious unsigned version that harvested SolarWinds and LDAP credentials, created a hidden _system login protected by a dynamic daily password, and erased audit traces of that access. The actor also used a public-facing web shell, abused WMIC for remote execution, and attempted to dump Active Directory data, while post-compromise activity included masquerading tools such as procdump.exe and winrar.exe as wininit.exe. Splunk, Microsoft, and community defenders published detections focused on process creation telemetry such as Event ID 4688, suspicious Orion file changes, known SUPERNOVA hashes, and anomalous SolarWinds-related network and process activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Splunk published analysis of the CISA-reported SUPERNOVA intrusion, highlighting adversary use of U.S.-based residential IPs, obfuscated PowerShell, LSASS credential dumping, exfiltration through a web server, and renamed tools such as procdump.exe masquerading as wininit.exe or Splunklogger.exe. The post also provided Splunk and Sysmon hunting guidance tied to the incident's indicators and behaviors.
CISA issued analyst report AR21-112A describing an incident response engagement involving the SUPERNOVA web shell on a compromised SolarWinds Orion server. The report documented post-compromise activity including VPN access with valid accounts, credential dumping, exfiltration, and masquerading.
A GitHub gist published Microsoft Defender for Endpoint KQL detections for SolarWinds compromise activity, including known SUNBURST domains and hashes and the SUPERNOVA MD5 hash. The material focused on operational detection logic rather than incident reporting.
After Sophos disclosed the NTDS dumping and related intrusion activity, the customer reset affected credentials, initiated domain-wide password resets, isolated implicated hosts, blocked suspicious IPs, and rebuilt systems. These actions were taken to contain and remove the Orion backdoor and associated web shell access.
Sophos discovered an ASPX web shell named about.aspx on the public web server and found that the attacker had copied a malicious unsigned file into the SolarWinds Orion bin directory as OrionWeb.dll. Reverse engineering showed the DLL captured SolarWinds and LDAP credentials, enabled a hidden '_system' login, and deleted related audit evidence.
During the November 2020 intrusion, the attacker used w3wp.exe-launched commands, created backup.bat remotely, and ran ntdsutil with 'ifm create full' to dump the Active Directory database from a domain controller. Sophos assessed this as credential access and privilege escalation activity.
In November 2020, Sophos MTR detected suspicious WMIC activity in the customer's environment, indicating a new intrusion distinct from the earlier Ragnar Locker incident. The activity traced back to a public IIS web server and led to broader investigation.
Sophos said the U.S.-based ISP and telecommunications customer had previously suffered a Ragnar Locker ransomware attack, and Rapid Response determined the threat actor had been in the network for two months before deployment. This earlier incident preceded the later SolarWinds Orion backdoor intrusion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourceus-cert.cisa.gov
Open sourcesplunk.com
Open sourcegist.github.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds disclosed that the **SUNBURST** compromise of its Orion platform led to actual follow-on intrusions at fewer than 100 customers, despite roughly 18,000 organizations downloading tainted updates. Investigators said the attackers, widely attributed by the U.S. government to Russia’s **SVR** and tracked as **NOBELIUM/UNC2452/Dark Halo**, inserted a backdoor into signed Orion updates and used delayed activation, DNS-based victim profiling, and selective second-stage deployment to focus on high-value targets. Victims included U.S. government agencies and private-sector organizations, while related activity also reached Mimecast, where the same actor accessed encrypted customer service account credentials and compromised certain authentication certificates affecting a small number of Microsoft 365 tenants. Incident response findings showed the campaign extended well beyond the initial Orion malware, with attackers stealing email, moving laterally through on-premises networks, bypassing MFA in some cases, forging SAML tokens, and abusing Azure AD and Microsoft 365 to access cloud resources. Research from Volexity, Symantec, Microsoft, and others detailed command-and-control through `avsvmcloud[.]com`, HTTP-based second-stage operations, mailbox theft, and stealthy use of legitimate identity infrastructure. In response, **CISA** issued an emergency directive, released the **CHIRP** detection tool, and published eviction guidance warning that full remediation may require rebuilding identity systems, rotating credentials, and isolating affected networks to remove long-term adversary access.
Aug 15, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Aug 21, 2026
Investigations into SolarWinds-related compromises have highlighted two distinct but high-impact intrusion paths: the **SUNBURST** supply-chain compromise affecting SolarWinds Orion customers and a later **path traversal** flaw in SolarWinds Serv-U tracked as `CVE-2024-28995`. Fidelis reported on incident response and forensic analysis tied to the Orion compromise, where attackers leveraged trojanized software updates to gain footholds in victim environments, while Censys documented internet-exposed Serv-U systems affected by the traversal vulnerability and the resulting urgency around patching and exposure reduction. Threat reporting has also linked SolarWinds activity to broader nation-state tradecraft. Dragos has tracked **ALLANITE**, an activity group associated with espionage against critical infrastructure, in the wider context of campaigns involving trusted third-party relationships and stealthy post-compromise operations. Together, the reporting shows SolarWinds remaining a recurring focal point for defenders, both as a victim of supply-chain abuse and as a vendor whose products have presented exploitable attack surface requiring rapid mitigation.
Jul 12, 2026