Loading malware…
SUNBURST, also widely known as Solorigate, is a Windows backdoor implanted into legitimate SolarWinds Orion software as part of a major supply-chain compromise attributed to the Russian state-sponsored actor commonly tracked as APT29/UNC2452. The malware was distributed through trojanized Orion updates that were digitally signed, allowing it to execute inside trusted enterprise environments and reach high-value government and private-sector victims globally.
SUNBURST was designed for stealth, selective activation, and long-term post-compromise access. It delayed execution, checked for antivirus and endpoint security products, and used process-name blocklists to avoid running in monitored or analysis-heavy environments. It performed host reconnaissance by collecting system and user information including hostname, operating system details, username, uptime, domain and network configuration, service and driver information, and process listings. It also queried system identifiers and enumerated files and directories.
For command and control, SUNBURST used HTTP GET and POST traffic as well as DNS-based communications crafted to resemble normal SolarWinds Orion Improvement Program activity. Its traffic employed multiple obfuscation layers, including Base64 encoding, compression, junk data insertion, faux structured formatting, and single-byte XOR encryption. The malware could receive commands to modify or delete registry data, disable services, delete files, and execute follow-on actions. Observed tradecraft included use of VBScript and Rundll32 to launch additional payloads, and delivery of second-stage malware such as TEARDROP in at least some intrusions.
The malware also supported defense evasion and cleanup. It checked for security tooling before execution, attempted to disable security-related services, and removed artifacts such as persistence-related registry values, proxy settings, and firewall rules created during operations. Its use of trusted SolarWinds software as the delivery vehicle, combined with careful operational security and selective post-exploitation, made SUNBURST one of the most consequential espionage backdoors uncovered in enterprise software supply-chain operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro's Zero-Day Initiative (ZDI) provided technical analysis of recently patched vulnerabilities in the SolarWinds Orion Platform. CVE-2020-14005, one of these vulnerabilities, has been linked to the recent SUNBURST cyberattack on SolarWinds. These vulnerabilities, when combined, could allow an unauthenticated attacker to execute arbitrary code as Administrator on an affected system. | The attackers used the access provided by this application to plant a backdoor known as Sunburst onto affected machines.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor.
...18,000 of its 300,000 customers downloaded a version of its Orion software that was tainted with the Sunburst malware, the attackers activated the malware only on a handful of customers networks.
The malicious builds were later used to deliver a backdoor tracked as Sunburst to "fewer than 18,000," but, luckily, the threat actors only picked a substantially lower number of targets for second-stage exploitation.
Kaspersky also made a connection between the Russian Turla hacking group and the SolarWinds hackers after finding feature overlaps between the Sunburst backdoor and the Kazuar backdoor linked to Turla in the past.
Once installed, SUNBURST would sleep for 12-14 days before it contacted the group’s C&C domain via DNS.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.
SUNBURST removed HTTP proxy registry values to clean up traces of execution.
private enum JobEngine { ... DeleteFile, ... } | DeleteFile ... File.Delete(Environment.ExpandEnvironmentVariables(args[0]));
SUNBURST also removed the firewall rules it created during execution.
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
CollectSystemDescription ... Environment.UserName ... new NTAccount(domainName, "Administrator").Translate(typeof(SecurityIdentifier))
private enum JobEngine { ... RunTask, GetProcessByDescription, KillTask, ... } | GetProcessByDescription ... foreach (Process process in Process.GetProcesses()) ... Select * From Win32_Process
private enum JobEngine { Idle, Exit, SetTime, CollectSystemDescription, UploadSystemDescription, ... } | Job.CollectSystemDescription ... result = result + ... domainName ... HostName ... Environment.UserName ... GetOSVersion(true) ... Environment.SystemDirectory ... GetNetworkAdapterConfiguration();
private enum JobEngine { ... GetFileSystemEntries ... } | private enum JobEngine { ... GetFileSystemEntries, WriteFile, FileExists, DeleteFile, GetFileHash, ... } | GetFileSystemEntries ... Directory.GetFiles(path, searchPattern) ... Directory.GetDirectories(path, searchPattern)
CreateUploadRequestImpl ... request.Method = "GET"; if (inData != null) { request.Method = "POST"; ... } ... using (WebResponse response = request.GetResponse()) | private enum HttpOipExMethods { Get, Head, Put, Post }
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
CryptoHelper builds domain strings with GetStatus(); GetPreviousString/GetNextString append encoded data to subdomains, and DnsHelper.GetIPHostEntry(hostName) resolves them. | DnsHelper.GetAddressFamily(hostName, dnsRecords) ... Dns.GetHostEntry(hostName) ... hostName = cryptoHelper.GetCurrentString()/GetNextString...
this.proxy = HttpProxySettings.Instance.AsWebProxy(); ... this.proxy = WebRequest.GetSystemWebProxy();
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.
KillTask(string[] args) { Process.GetProcessById(int.Parse(args[0])).Kill(); } | SetManualMode ... registryKey2.SetValue("Start", 4, RegistryValueKind.DWord);
1,938 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in the SolarWinds compromise, featuring DNS-based command-and-control beaconing and DGA-style subdomain activity discussed here through log analysis and detection gaps.
Backdoor implanted into SolarWinds Orion via a compromised build pipeline and distributed through legitimate software updates as part of a supply-chain attack.
A backdoor implanted into Trojanized SolarWinds Orion software updates that beaconed to attacker-controlled C2 infrastructure, enabled remote access, and could facilitate delivery of additional malware and data exfiltration.
Backdoor malware injected into trojanized SolarWinds Orion updates and distributed through signed software updates.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.