Loading malware…
SUNSPOT is a custom Windows implant used in the SolarWinds Orion software supply-chain compromise. It was associated with APT29, also tracked as NOBELIUM or UNC2452, and operated inside the SolarWinds build environment to tamper with the software compilation process. Rather than functioning as a conventional endpoint backdoor, SUNSPOT was designed to monitor the build server for Orion compilation activity and covertly alter source files at the moment of build execution so that the SUNBURST backdoor would be compiled into legitimate Orion releases.
SUNSPOT monitored running processes for the Orion build workflow, including instances of MsBuild.exe, and extracted command-line context to identify the targeted Visual Studio solution path. When the expected build conditions were met, it backed up the legitimate Orion source file, wrote a malicious replacement containing SUNBURST from encrypted blobs, moved the replacement into place so it would be compiled under the original source filename, and then restored the original file after the build completed. This workflow allowed the malicious code to be inserted transiently during compilation while minimizing visible changes to the source tree. The malware also performed hash verification checks to ensure the targeted source file matched expected content before replacement.
The implant used Windows API functions including file and process information routines as part of its source-file swap and build-monitoring logic. It decrypted the SUNBURST payload from AES-128-CBC encrypted blobs and used temporary backup and staging files during the replacement process. After successful injection and restoration, SUNSPOT deleted temporary artifacts to reduce forensic visibility. It also maintained persistence on the compromised build host through a scheduled task that executed at boot.
SUNSPOT is notable as a purpose-built build-system implant optimized for stealth, stored data manipulation, and defense evasion in a CI/CD environment. Its role was to enable initial insertion of a downstream backdoor into signed software updates rather than to directly conduct broad victim-side espionage itself. The malware targeted Windows build infrastructure in an enterprise software development environment and played a central role in one of the most consequential software supply-chain intrusions publicly documented.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Details of the SolarWinds software compromise SUNSPOT malware can be found in the CrowdStrike report ... Deploy malware on build server, set mutexes and log files locally. Monitor for the build process to start ... replace the target code files with malicious code files. Once build is complete, replace malicious code files with legitimate code from the backups created. | This detection logic was chosen to allow for the potential detection of other threat actors attempting to perform any similar attack, rather than just a detection of the specific SUNSPOT malware.
Nobelium had managed to compromise the SolarWinds software build environment and used a custom implant called SUNSPOT to load the SUNBURST backdoor into the Orion software update.
In a blog post late last night, the infosec firm said the Orion-targeting malware, which it codenamed Sunspot, had "several safeguards" to ensure its deployment of compromised code into new Orion builds didn't trigger SolarWinds' suspicions.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
New Package Feed Created. ATT&CK Technique: T1195 Description: An attacker could look to introduce upstream compromised software packages by creating a new package feed within Azure DevOps. | The recent NOBELIUM incident has brought the issue of supply chain security into sharp focus, particularly that of the software supply chain.
As part of the attack, the hackers gained access to the SolarWinds Orion build system and injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software. This DLL was later automatically distributed to SolarWinds customers in a supply chain attack.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
let build_processes = dynamic ( [ "MSBuild.exe" , "dontnet.exe" , "VBCSCompiler.exe" ] )
The Microsoft Threat Intelligence Center (MSTIC) has created a detection query for Azure Sentinel to look for the pattern of code files being modified when a build process is run... This detection logic was chosen to allow for the potential detection of other threat actors attempting to perform any similar attack, rather than just a detection of the specific SUNSPOT malware. | Look for build process starts ... join ... Look for file modifications to code file ... where BuildProcessTime <= FileEditTime
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Akira has used legitimate names and locations for files to evade defenses.
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
Once build is complete, replace malicious code files with legitimate code from the backups created.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
let build_processes = dynamic ( [ "MSBuild.exe" , "dontnet.exe" , "VBCSCompiler.exe" ] )
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
The Microsoft Threat Intelligence Center (MSTIC) has created a detection query for Azure Sentinel to look for the pattern of code files being modified when a build process is run... This detection logic was chosen to allow for the potential detection of other threat actors attempting to perform any similar attack, rather than just a detection of the specific SUNSPOT malware. | Look for build process starts ... join ... Look for file modifications to code file ... where BuildProcessTime <= FileEditTime
After being executed, the malware would monitor and automatically injecting a Sunburst backdoor by replacing the company's legitimate source code with malicious code... injected the sunburst backdoor into a legitimate DLL used by the SolarWinds Orion IT management software.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Their toolkit includes ... SUNBURST, SUNSPOT, SUPERNOVA, TEARDROP...
A custom implant used in the SolarWinds compromise to insert the SUNBURST backdoor into Orion software builds.
Implant referenced in citation material.
APT29 malware used in the SolarWinds compromise, including for persistence via a scheduled task at host boot.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.