#SOLARWINDS ORION PLATFORM .DLL#
#SOLARWINDS ORION PLATFORM MANUAL#
#SOLARWINDS ORION PLATFORM SOFTWARE#

A similar technique involved the temporary modification of system scheduled tasks by updating a legitimate task to execute a malicious tool and then reverting the task back to its original configuration. This means they modified a legitimate utility on the targeted system with their malicious one, executed it, and then replaced it back with the legitimate one. To avoid detection, attackers used temporary file replacement techniques to remotely execute their tools. Cobalt Strike is a commercial penetration testing framework and post-exploitation agent designed for red teams that has also been adopted and used by hackers and sophisticated cybercriminal groups. Researchers believe it was used to deploy a customized version of the Cobalt Strike BEACON payload. This dropper loads directly in memory and does not leave traces on the disk. The backdoor was used to deliver a lightweight malware dropper that has never been seen before and which FireEye has dubbed TEARDROP. The attackers kept their malware footprint very low, preferring to steal and use credentials to perform lateral movement through the network and establish legitimate remote access. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.' 'The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. 'After an initial dormant period of up to two weeks, it retrieves and executes commands, called 'Jobs,' that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services,' the FireEye analysts said. FireEye tracks this component as SUNBURST and has released open-source detection rules for it on GitHub. The trojanized component is digitally signed and contains a backdoor that communicates with third-party servers controlled by the attackers.

#SOLARWINDS ORION PLATFORM .DLL#

The attackers managed to modify an Orion platform plug-in called .dll that is distributed as part of Orion platform updates.

#SOLARWINDS ORION PLATFORM MANUAL#

However, FireEye noted in its analysis that each of the attacks required meticulous planning and manual interaction by the attackers.

#SOLARWINDS ORION PLATFORM SOFTWARE#

The software builds for Orion versions 2019.4 HF 5 through 2020.2.1 that were released between March 2020 and June 2020 might have contained a trojanized component.

FireEye has notified all entities we are aware of being affected.' The malicious Orion updates We anticipate there are additional victims in other countries and verticals. 'The victims have included government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East. 'FireEye has detected this activity at multiple entities worldwide,' the company said in an advisory Sunday.

Even though FireEye did not name the group of attackers responsible, the Washington Post reports it is APT29 or Cozy Bear, the hacking arm of Russia's foreign intelligence service, the SVR. The SolarWinds software supply chain attack also allowed hackers to access the network of US cybersecurity firm FireEye, a breach that was announced last week. On a page on its website that was taken down after news broke out, SolarWinds stated that its customers included 425 of the US Fortune 500, the top ten US telecommunications companies, the top five US accounting firms, all branches of the US Military, the Pentagon, the State Department, as well as hundreds of universities and colleges worldwide. The attack involved hackers compromising the infrastructure of SolarWinds, a company that produces a network and applications monitoring platform called Orion, and then using that access to produce and distribute trojanized updates to the software's users. The news triggered an emergency meeting of the US National Security Council on Saturday. ДЄ hacker group believed to be affiliated with the Russian government gained access to computer systems belonging to multiple US government departments including the US Treasury and Commerce in a long campaign that is believed to have started in March. The incident highlights the severe impact software supply chain attacks can have and the unfortunate fact that most organizations are woefully unprepared to prevent and detect such threats. The recent breach of major cybersecurity company FireEye by nation-state hackers was part of a much larger attack that was carried out through malicious updates to a popular network monitoring product and impacted major government organizations and companies.

Solarwinds orion platform