SolarWinds, a provider of network monitoring services, has issued a critical hotfix to resolve a significant vulnerability within its Orion platform. This security flaw has been linked to a large-scale espionage campaign that exploited the platform to install malware, affecting both public and private sector entities.
In an advisory posted on their website, SolarWinds has urged clients to upgrade to Orion Platform version 2020.2.1 HF 2 without delay to mitigate the risks associated with this vulnerability. The malware, identified as SUNBURST (or Solorigate), has impacted multiple versions of the Orion application released between March and June 2020.
According to SolarWinds’ investigation, the vulnerability appears to be limited to specific versions of the Orion platform, as the company asserts that no other versions, including any future iterations, are affected. Further analysis revealed that they found no traces of the malicious code in other products or agents offered by SolarWinds, including their free tools like RMM and N-Central.
Microsoft Takes Action
While details regarding the breach of SolarWinds’ internal network remain sparse, Microsoft recently announced that it has taken control of a key GoDaddy domain—avsvmcloud[.]com—utilized by the attackers for communication with compromised systems. Additionally, Microsoft plans to start blocking known malicious SolarWinds binaries effective immediately.
In parallel, security researcher Mubix “Rob” Fuller has created SolarFlare, an authentication audit tool designed to run on Orion machines to help detect potentially compromised accounts as a result of the breach. SolarWinds has acknowledged the complexity and sophistication of this attack, explaining that the vulnerability was purposefully designed to evade detection and activate under specific conditions.
Scope of the Breach
SolarWinds estimates that the supply chain attack may have impacted as many as 18,000 of its customers. However, evidence suggests that the attackers primarily targeted select high-profile organizations rather than a broad swath of affected clients. Cybersecurity firm Symantec reported identifying over 2,000 compromised computers across more than 100 customers, although it did not observe any further malicious activities on those machines.
As the impact of the breach is evaluated, SolarWinds faces increased scrutiny over its security posture. Reports indicate that the company’s software download service was secured by a simple password, which was publicly visible in its GitHub repositories. Moreover, attempts have been made by various cybercriminals to market access to SolarWinds’ systems on underground forums.
In response to the ongoing crisis, SolarWinds has opted to remove the client list from its website, a significant move intended to address privacy concerns following the breach. The incident has underscored the importance of cybersecurity hygiene and the potential risks associated with third-party software solutions.
As the investigation unfolds, it’s crucial for organizations utilizing SolarWinds’ products to not only implement the necessary updates but also adopt a proactive stance in monitoring their systems for unusual activities. The tactics and techniques employed in this incident likely align with the MITRE ATT&CK framework, involving initial access and persistence strategies that facilitated the breach.