Loading story…
The SolarWinds intrusion was carried out through trojanized Orion software updates that delivered the SUNBURST backdoor to a wide range of victims, including U.S. government agencies and private-sector organizations. FireEye’s disclosure that its own network had been breached helped expose the broader campaign, which investigators and U.S. officials widely linked to Russian state espionage, with the SVR cited as the most likely actor. Reported victims included the Departments of State, Treasury, Commerce, Energy, Homeland Security, and the National Institutes of Health, and responders warned that eradication and recovery would take months.
Technical analysis showed SUNBURST was engineered for stealth: it could delay execution for up to 14 days, avoid test and lab environments, check for security tools and researcher systems, and even modify Windows service registry settings to weaken some protections after reboot. The malware used domain generation and HTTP(S) command-and-control, then exfiltrated data with encrypted POST requests—sending large payloads as compressed, XOR-obfuscated application/octet-stream data and hiding smaller payloads inside fake JSON structures with Base64 chunks. In response, defenders published threat-hunting resources, indicators of compromise, Splunk and SQL queries, and tools that emulate SUNBURST’s blacklist logic to identify processes, services, and drivers that would cause the malware to terminate.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
Microsoft published technical analysis of additional Nobelium malware families—GOLDMAX, GOLDFINDER, and SIBOT—expanding public understanding of the post-SolarWinds toolset and tradecraft used by the operators.
Microsoft published its Solorigate resource center, consolidating guidance, research, and updates related to the SolarWinds-linked campaign later tracked as Nobelium. The page was updated on March 4, 2021, reflecting Microsoft's ongoing public response and defender support efforts.
NPR reported that multiple U.S. agencies, including State, Treasury, Commerce, Energy, Homeland Security, and NIH, were affected, and that U.S. officials such as Mike Pompeo viewed Russia's SVR as the most likely actor.
A visible commit labeled "Correction" was made to Sophos's SolarWinds threat-hunting repository, reflecting continued maintenance of its defensive guidance and IOC resources.
Cado Security published a de-obfuscated OrionImprovementBusinessLayer.cs source file for the SUNBURST backdoor, exposing its delayed activation, victim fingerprinting, DNS-to-HTTP command-and-control flow, and extensive remote tasking capabilities. The code also revealed anti-analysis checks, service and registry manipulation logic, and embedded infrastructure references including avsvmcloud.com and appsync-api.
Sophos published the "solarwinds-threathunt" GitHub repository with collated IOCs, SQL queries, and Splunk searches to help defenders identify vulnerable SolarWinds servers and hunt for compromise.
FireEye announced on December 8 that it had been breached and that some of its offensive security tools were stolen, helping expose the broader SolarWinds espionage campaign.
According to FireEye's Kevin Mandia, the attackers deployed actual malicious code in SolarWinds Orion updates from March through June 2020, establishing the SUNBURST supply-chain compromise.
Kevin Mandia said the attackers inserted an innocuous code addition into the SolarWinds supply chain in October 2019 to validate their access and technique before deploying the full malicious capability.
A technical analysis detailed how the trojanized SolarWinds.Orion.Core.BusinessLayer.dll was loaded by SolarWinds.BusinessLayerHost.exe, described SUNBURST's victim-ID generation and avsvmcloud.com C2 hostname scheme, and published associated file hashes and domains. The write-up also documented dormancy, single-instance enforcement, AD-domain checks, and repeated blacklist checks for security tools, services, and drivers.
Symantec published technical analysis of how SUNBURST sends data back to operators using HTTP(S) POST requests, including large-payload XOR-encrypted blobs and smaller payloads hidden in fake JSON structures.
SentinelLabs published SolarWinds_Countermeasures, a tool that replicates SUNBURST's process, service, and driver blacklist logic to show whether the malware would exit on a given system.
Symantec published analysis showing SUNBURST delayed execution, checked for lab environments and security tools, and attempted to disable some security products through Windows service registry changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
notes.netbytesec.com
Open sourceaka.ms
Open sourcesymantec-enterprise-blogs.security.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceen.wikipedia.org
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that attackers used the **SUNBURST** backdoor in the SolarWinds supply chain compromise to gain covert access to victim environments and conduct highly evasive follow-on operations. The activity stemmed from trojanized SolarWinds Orion software updates, which allowed the threat actor to establish an initial foothold through trusted software and then selectively expand access inside targeted networks. The intrusion set was notable for stealth and operational discipline, with attackers using the compromised Orion platform to blend into normal administrative activity and reduce the chance of detection. The case underscores the long-term impact of software supply chain compromises, where a single trusted update mechanism can provide broad downstream access and enable persistent espionage across multiple organizations.
Jun 29, 2026
A suspected Russian intelligence operation compromised SolarWinds' Orion software build process and pushed trojanized updates containing the **`SUNBURST`** backdoor to customers beginning in 2020, giving attackers a stealthy foothold inside government and private-sector networks. U.S. agencies including Treasury, Commerce, Homeland Security, State, and parts of the Pentagon were drawn into the response, while investigators and public reporting said roughly **18,000** customers received the malicious update and a smaller set suffered follow-on intrusions. FireEye's discovery of its own breach helped expose the campaign, and later technical reporting tied the operation to second-stage malware including **`TEARDROP`** and **`Raindrop`**, with officials assessing the activity as a long-running espionage effort rather than destructive sabotage. The victim list expanded beyond federal agencies to major enterprises and institutions including **Cisco, Intel, Nvidia, VMware, Deloitte, Belkin, Kent State University**, and **Malwarebytes**, though several said they found the tainted software without evidence of deeper compromise. Subsequent reporting and congressional scrutiny also focused on how the attackers abused Microsoft cloud and identity weaknesses to impersonate users and access email, with lawmakers pressing Microsoft over claims that internal warnings had been missed before the SolarWinds campaign. SolarWinds' CEO later apologized for blaming an intern for a weak password issue, and said the intrusion may have begun as early as **2019**, underscoring how long the attackers may have operated undetected and how difficult remediation became for affected organizations and critical infrastructure operators.
Aug 14, 2026
SolarWinds disclosed that the **SUNBURST** compromise of its Orion platform led to actual follow-on intrusions at fewer than 100 customers, despite roughly 18,000 organizations downloading tainted updates. Investigators said the attackers, widely attributed by the U.S. government to Russia’s **SVR** and tracked as **NOBELIUM/UNC2452/Dark Halo**, inserted a backdoor into signed Orion updates and used delayed activation, DNS-based victim profiling, and selective second-stage deployment to focus on high-value targets. Victims included U.S. government agencies and private-sector organizations, while related activity also reached Mimecast, where the same actor accessed encrypted customer service account credentials and compromised certain authentication certificates affecting a small number of Microsoft 365 tenants. Incident response findings showed the campaign extended well beyond the initial Orion malware, with attackers stealing email, moving laterally through on-premises networks, bypassing MFA in some cases, forging SAML tokens, and abusing Azure AD and Microsoft 365 to access cloud resources. Research from Volexity, Symantec, Microsoft, and others detailed command-and-control through `avsvmcloud[.]com`, HTTP-based second-stage operations, mailbox theft, and stealthy use of legitimate identity infrastructure. In response, **CISA** issued an emergency directive, released the **CHIRP** detection tool, and published eviction guidance warning that full remediation may require rebuilding identity systems, rotating credentials, and isolating affected networks to remove long-term adversary access.
Aug 15, 2026