Resources related to the SolarWinds supply chain breach, connected to the FireEye breach, that identified Sunburst and Supernova. Attribution hasn't been confirmed and FireEye have associated with campaign UNC2452, with several media outlets reporting intelligence agencies are attributing the attack to Russian intelligence.
- BBC News: CES 2021: Microsoft's Brad Smith slams SolarWinds 'indiscriminate assault'
- CBS News: SolarWinds: How Russian spies hacked the Justice, State, Treasury, Energy and Commerce Departments
- ZDNet: A second hacking group has targeted SolarWinds systems
- ZDNet: CISA: SolarWinds hackers also used password guessing to breach targets
- ZDNet: Fourth malware strain discovered in SolarWinds incident
- ZDNet: Four security vendors disclose SolarWinds-related incidents
- ZDNet: Microsoft: SolarWinds attack took more than 1,000 engineers to create
- ZDNet: SolarWinds patches three newly discovered software vulnerabilities
- The Register: Microsoft SolarWinds analysis: Attackers hid inside Windows systems by wearing the skins of legit processes
- TheCyberWire: Cozy Bear's attack on FireEye affected more than one company, and was based on a compromised SolarWinds update
- CRN: Crowdstrike Fends Off Attack Attempted By SolarWinds Hackers
- CRN: AWS: SolarWinds Hackers Used Our Elastic Compute Cloud
- Reuters: Exclusive - Microsoft breached in suspected Russian hack using SolarWinds
- Reuters: Experts who wrestled with SolarWinds hackers say cleanup could take months - or longer
- Reuters: Suspected Russian hackers used Microsoft vendors to breach customers
- Reuters: SolarWinds hackers linked to known Russian spying tools, investigators say
- Reuters: Exclusive: Suspected Chinese hackers used SolarWinds bug to spy on U.S. payroll agency – sources
- Infosecurity: New Malware Implant Discovered as Part of SolarWinds Attack
- Infosecurity: CrowdStrike Slams Microsoft Over SolarWinds Hack
- CyberScoop: All Articles tagged with SolarWinds
- CyberScoop: Microsoft alerts Crowdstrike of hackers' attempted break-in
- CyberScoop: NSA warns defense contractors of potential SolarWinds fallout
- CyberScoop: After SolarWinds breach, lawmakers ask NSA for help in cracking Juniper cold case
- CyberScoop: Mimecast breach investigators probe possible SolarWinds connection
- CyberScoop: Mimecast confirms SolarWinds attackers breached security certificate, 'potentially exfiltrated' credentials
- CyberScoop: Symantec connects another hacking tool to SolarWinds campaign
- CyberScoop: For Microsoft, cybersecurity has become bigger than business
- CyberScoop: Microsoft shares tool to hunt for compromise in SolarWinds breach
- CyberScoop: Senate hearing on SolarWinds hack lays bare US shortcomings, remaining mysteries
- The Intercept: SolarWinds Hack Infected Critical Infrastructure
- Securelist: Sunburst - connecting the dots in the DNS requests
- Securelist: Sunburst backdoor - code overlaps with Kazuar
- Bleeping Computer: The SolarWinds cyberattack - The hack victims and what we know
- BleepingComputer Malwarebytes says SolarWinds hackers accessed its internal emails
- Bleeping Computer: Microsoft: SolarWinds hackers downloaded Azure, Exchange source code
- The Wall Street Journal: Hackers Lurked in SolarWinds Email System for at Least 9 Months, CEO Says
- Security Week: Continuous Updates: Everything You Need to Know About the SolarWinds Attack
- Security Week: SolarWinds Likely Hacked at Least One Year Before Breach Discovery
- Security Week: New Zero-Day, Malware Indicate Second Group May Have Targeted SolarWinds
- Security Week: SolarWinds Taps Firm Started by Ex-CISA Chief Chris Krebs, Former Facebook CSO Alex Stamos
- Security Week: Similarities Found Between Malware Used in SolarWinds Attack and Backdoor Linked to Turla Cyberspies
- Security Week: Investigation Launched Into Role of JetBrains Product in SolarWinds Hack: Reports
- Security Week: Kaspersky Connects SolarWinds Attack Code to Known Russian APT Group
- Security Week: Microsoft Details OPSEC, Anti-Forensic Techniques Used by SolarWinds Hackers
- Security Week: CISA Says Many Victims of SolarWinds Hackers Had No Direct Link to SolarWinds
- Security Week: Microsoft Says Its Services Not Used as Entry Point by SolarWinds Hackers
- Schneier: Russia's SolarWinds Attack
- The Hacker News: 3 New Severe Security Vulnerabilities Found In SolarWinds Software
- Forbes: 1,500 SolarWinds Customers Are Exposing Themselves To Hackers As 'Russian' Espionage Continues
- Security Affairs: CISA revealed that threat actors behind the SolarWinds hack also used password guessing and password spraying in its attacks
- Security Affairs: SolarWinds hackers also used common hacker techniques, CISA revealed
- Security Boulevard: How X.509 Certificates Were Involved in SolarWinds Attack | Keyfactor
- Security Boulevard: Hackers Didn’t Only Use SolarWinds to Break In, Says CISA
- Wired: The SolarWinds Hackers Shared Tricks With a Notorious Russian Spy Group
- Wired: The SolarWinds Hackers Used Tactics Other Groups Will Copy
- Wired: A Second SolarWinds Hack Deepens Third-Party Software Fears
- The Guardian: DoJ confirms email accounts breached by SolarWinds hackers
- Financial Times: SolarWinds cyber attack linked to tools used by Russian hacking group
- CNN: SolarWinds hackers gave themselves top administrative privileges to spy on victims undetected, DHS says
- arsTECHNICA: SolarWinds malware has “curious” ties to Russian-speaking hackers
- Council on Foreign Relations: Most Tools Failed to Detect the SolarWinds Malware. Those That Did Failed Too
- The Street: SolarWinds Says It Has Found Source of Massive Cyberattack
- cna: SolarWinds hackers linked to known Russian spying tools, investigators say
- techradar: SolarWinds hackers also guessed passwords of many victims
- FCW: CISA: Hackers access to federal networks without SolarWinds
- Market Watch: SolarWinds has found and reverse engineered 'highly sophisticated and malicious' code used in recent cyberattack
- Barron's: The SolarWinds Hack Was Huge. Here’s Why JPMorgan Is Defending the Stock.
- Fox Business: Cybersecurity firm identifies third SolarWinds hack malware strain
- Fox Business: SolarWinds shareholder files class-action lawsuit alleging leadership 'misrepresented and failed to disclose' information about hack
- The Hill: Hackers had access to SolarWinds email system for months: report
- State Scoop: No evidence SolarWinds hack touched election systems, acting CISA chief says
- CNBC: CrowdStrike CEO on who bears responsibility for SolarWinds hack
- Security Advisory
- SolarWinds Update on Security Vulnerability
- Our Commitment to Cooperation
- Our Plan for a Safer SolarWinds and Customer Community
- New Findings From Our Investigation of SUNBURST
- Sunburst Malware
- Sunburst Additional Technical Details
- Global Intrusion Campaign Leverages Software Supply Chain Compromise
- Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST backdoor
- Mandiant UNC2452 - Highly Evasive Attacker Leverages Supply Chain to Compromise Targets Presentation Slides
- FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community
- Unauthorized Access of FireEye Red Team Tools
- FireEye Red Team Tool Countermeasures
- FireEye Mandiant SunBurst Countermeasures
- UNC2452 Actor Overview
- Sunburst Malware Overview
- Sunburst Malware Profile
- Teardrop Malware Overview
- DebUNCing Attribution to Counter Threats More Effectively
- New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452
- Solorigate Resource Center
- Important steps for customers to protect themselves from recent nation-state cyberattacks
- Ensuring customers are protected from Solorigate
- A moment of reckoning: the need for a strong and global cybersecurity response
- Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers
- Microsoft Internal Solorigate Investigation
- SolarWinds Post-Compromise Hunting with Azure Sentinel
- Understanding "Solorigate's" Identity IOC's - for Identity Vendors and their customers
- Azure AD workbook to help you assess Solorigate risk
- Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
- Strategies for Microsoft 365 to Defend Against UNC2452
- Microsoft Internal Solorigate Investigation – Final Update
- Using Zero Trust principles to protect against sophisticated attacks like Solorigate
- Supply Chain Compromise
- AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
- AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
- Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise
- NCSC statement on the SolarWinds compromise
- NCSC Enhanced Guidance on SolarWinds Incident: TLP Amber
- Recorded Future: SolarWinds Attribution - Are We Getting Ahead of Ourselves?
- Recorded Future: SolarWinds: What the Intelligence Tells Us
- Splunk: Using Splunk to Detect Sunburst Backdoor
- Splunk: A Golden SAML Journey - SolarWinds Continued
- Volexity: Responding to the SolarWinds Breach - Detect, Prevent, and Remediate the Dark Halo Supply Chain Attack
- Volexity: Dark Halo Leverages SolarWinds Compromise to Breach Organizations
- Palo Alto's UNIT42: SolarStorm Timeline - Details of the Software Supply-Chain Attack
- SentinelLabs: SolarWinds - Understanding & Detecting the SUPERNOVA Webshell Trojan
- Check Point Research: SUNBURST, TEARDROP and the NetSec New Normal
- Sygnia: Detection of Golden SAML attacks
- Fortinet FortiGuard Labs: What We Have Learned So Far about the "Sunburst"-SolarWinds Hack
- Symantec/Broadcom: Raindrop: New Malware Discovered in SolarWinds Investigation
- TrustedSec: SolarWinds Backdoor (Sunburst) Incident Response Playbook
- TrustedSec: SolarWinds Orion and UNC2452 - Summary and Recommendations
- Netresec: Reassembling Victim Domain Fragments from SUNBURST DNS
- Netresec: Robust Indicators of Compromise for SUNBURST
- Netresec: Finding Targeted SUNBURST Victims with pDNS
- Netresec: Extracting Security Products from SUNBURST DNS Beacons
- Netresec: Twenty-three SUNBURST Targets Identified
- Immersive Labs: Feel the heat of SUNBURST with Immersive Labs (so your business won't have to)
- Immersive Labs: SUNBURST - When the sun bursts: responding to global cyber events
- Katie Nickels: Twitter: A brief thread on the @Crowdstrike blog on SUNSPOT...
- SimeonOnSecurity.ch: SolarWinds Orion Supply Chain Compromised, C2, and Mitigations
- SimeonOnSecurity.ch: GitHub - SolarWinds Sunburst Countermeasures
- z3r0trust: SUNBURST Malware Used Digital Steganography
- @MalwareRE: Twitter Thread
- Carnegie Mellon CERT Coordination Center: Vulnerability Note VU#843464 SolarWinds Orion API authentication bypass allows remote code execution
- Securehat: Extracting the Cobalt Strike Config from a TEARDROP Loader
- 2igosha: SUNBURST DGA decoder
- RedDrip7: SunBurst DGA Decode Script
- CISA: Sparrow.ps1
- Command Post Technologies: SolarWinds Exploit Hash Hunter
- Crowdstrike: Crowdstrike Launches Free Tool to Identify and Help Mitigate Risks in Azure Active Directory
- Crowdstrike: Crowdstrike Reporting Tool for Azure (CRT)
- Crowdstrike: CRT (Crowdstrike Reporting Tool for Azure)
- FireEye/Mandiant: FireEye Mandiant SunBurst Countermeasures
- FireEye/Mandiant: Mandiant Azure AD Investigator
- JoeW: SolarWinds IOC Scanner
- Microsoft: Protecting Microsoft 365 from on-premise attacks
- Mubix: SolarFlare Release: Password Dumper for SolarWinds Orion
- Neo23x0: Sigma Rule: UNC2452 PowerShell pattern
- TeachJing: Animated SolarWinds Breach Attack Flow - EP1
- TeachJing: SolarWinds Breach | Protecting from on-premises attacks | EP2
- TeachJing: Solarwinds Breach Update | UCG is formed and CISA release a Free Tool - Sparrow.ps1 | EP3
- TeachJing: Solarwinds Breach Update | CISA has Important update to Emergency Directive as of Jan 6 | EP4
- McCrary Institute: SolarWinds: What It Means & What’s Next
- Corelight, Inc: Finding SolarWinds / SUNBURST backdoors with Zeek & Corelight
- Infosec: Memory forensics demo: SolarWinds breach and Sunburst malware | Cyber Work Podcast
- Infosec: SolarWinds breach: Insights from the trenches | Live incident response demo | Cyber Work Podcast
- Colin Hardy: SUNBURST SolarWinds Malware - Tools, Tactics and Methods to get you started with Reverse Engineering
- SANS Institute: SANS Emergency Webcast: What you need to know about the SolarWinds Supply-Chain Attack
- Ean Meyer: SolarWinds Vulnerability Info
- Subfission: SUNBURST Data Aggregation
- Will Oram: Azure AD Incident Response - note for understanding the techniques used by solarWinds actor to facilitate long-term access to Microsoft environments
- Jetbrains: Statement on the story from The New York Times regarding JetBrains and SolarWinds
- Jetbrains: An Update on SolarWinds
- Jetbrains: January 8th Update on SolarWinds
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- TEARDROP
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST
- SUNBURST