sunburst

This repository contains NBI and file hashes to help researchers detect SUNBURST. Many different organizations are providing hashes others aren't. This is just an attempt to compile all indicators, some hunting techniques, and some summarized analysis of the reports available for responders to hopefully help fellow responders with our work.

View VirusTotal Infrastructure Graph

I am pulling the unique hostnames form multiple sources and compiling the list at sunburst-hunting/indicators/uniq-hostnames.csv. We contacted organizations we had contacts for while we learned who may have been a stage 2 target but wanted to wait several weeks until other open sources provided lists of affected organizations. Now that others are publishing these targets we also have created a list to help those who wish to see if their organization is known to be affected at sunburst-hunting/decoded_names_and_potential_organizations.csv.

Most of these NBI provided to help researchers and threat hunters can be used as high confidence. This is except the indicators provided by John Bambenek shortly after Sunburst which appears now to be unrelated to Sunburst activity or even to UNC2452. This list was dumped from Open Source Contex Data-Library. It includes redirects and isn't curated to only include Sunburst content. It is not advised to use production tools to identify or scope the Sunburst incident. The repo's name is 'research' and it is likely intended to used for just that.

The file hashes are known compromised, high confidence.

Attribution

FireEye is tracking this adversary as UNC2452, but some have conjectured that this may be activity from the recently dormant APT29 / Cozy Bear. At this time, not enough information is available to confirm that APT29 is behind this attack.

Execution

Execution The backdoor infected .dll in the SolarWinds install directory, when executed, installs the implant as a Windows service and .dll file in the following directories.

SolarWinds DLL in install folder

PROGRAMFILES\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll

Main implant

WINDIR\System32\config\systemprofile\AppData\Local\Assembly\tmp$varriable_folder_name$\SolarWinds.Orion.Core.BusinessLayer.dll.

Period of Dormancy

Period of Dormancy After a dormant period of around two weeks, it executes commands, called Jobs, including various capabilities such as the ability to profile the system, reboot the machine, disable services, transfer files, and load additional malware. The malicious DLL communicates to avsvmcloud[dot]com using DGA subdomains to prepare possible second-stage malware, accomplish lateral movement, or exfiltrate data. It masquerades its network traffic as the Orion Improvement Program protocol. It stores obtained recon data in legitimate plug-in config files. Its actions all intend to mimic the activity expected from Orion.

Second-Stage Payloads

Along with SUNBURST, samples have been observed dropping a memory-only dropper called TEARDROP, which was used to deploy Cobalt Strike beacons, a popular tool by many of our adversaries.

Implant Sunpot

Malware to insert the SUNBURST backdoor into Orion software. It replaces a source file that includes the backdoor.

Command and Control (C2)

As noted, the adversaries use domain generated algorithms (DGA) to build subdomains of the avsvmcloud[dot]com. This communication can be used for the additional payloads or to exfiltrate data. Hostnames have matched those found monitored by the victim’s Orion instance. It appears that the adversary will also use VPS infrastructure hosted in the same country as the victim.