The cyber security industry is reeling from another large scale, targeted attack. What was initially reported as a breach of FireEye red team tools on December 8th has now been exposed as a much wider, potentially catastrophic breach affecting the SolarWinds Orion software. SolarWinds stated a threat actor inserted malware, SUNBURST or Solorigate, into a service providing trojanized software updates for its Orion platform, used by public and private companies to track IT resources. To date (December 16th, 2020), as many as 18,000 organizations have been affected by SUNBURST, announced SolarWinds. On December 14, Reuters and the Washington Post reported the U.S. Department of Homeland Security (DHS), the State Department, and the National Institutes of Health (NIH) were also compromised as a result of the infected Orion distribution.
Like many in the cyber security community, GroupSense has been hard at work understanding the extent to which our clients may be vulnerable to FireEye’s breached red team tools or impacted by SUNBURST. FireEye reported the stolen red team tools ranged from simple scripts used for automating reconnaissance to entire frameworks similar to publicly available technologies such as CobaltStrike and Metasploit. Thankfully, FireEye quickly published a list of CVEs leveraged by these tools. GroupSense conducted a passive scan of customer-related outward-facing infrastructure for any potential exposure to the vulnerabilities that the stolen FireEye red team tools exploit. We alerted affected customers to these vulnerabilities on December 14.
GroupSense obtained a decoded list of SUNBURST domain generation algorithm (DGA) domains used for command and control (C&C) purposes when exfiltrating data from victim networks. The DGAs were generated by taking the domain of the infected computer and encoding certain information about the domain to generate an assigned value. The assigned value is then utilized to create the URL used as the infected domain’s SUNBURST C&C messaging conduit. All SUNBURST DGAs were created on the avsvmcloud[.]com domain which has been seized and de-weaponized by Microsoft.
SUNBURST domain example: 0bv6kouis4gtgs1be2sd0tdieo0te2h.appsync-api.us-east-2.avsvmcloud[.]com
This example was decoded to: corp.ptci[.]com. GroupSense analysts noticed the maximum amount of characters used to encode was 15. This results in incomplete decoded values where “csnt.princegeor” for example, should at the very least say “princegeorge.” We can't say that the decoded information conclusively means an organization is being targeted or has had any data exfiltrated. The only thing we can say with high confidence is any computer associated with this domain has the SUNBURST malware.
To completely understand SUNBURST, GroupSense has sought information on the threat actors conducting this attack. FireEye originally designated the threat actors as UNC2452, however knowledgeable sources familiar with the investigation told Reuters and the Washington Post the Russian government-backed advanced persistent threat (APT) espionage actor APT29, also known as Cozy Bear, is the likely culprit. APT29 is operated by the Russian Foreign Intelligence Service (SVR). Since its emergence in 2008, the group has targeted government agencies, think tanks, and organizations conducting COVID-19 vaccine research. Known targets of the SUNBURST supply chain attack are consistent with previous targeting patterns by APT29.
- Organizations that use the SolarWinds Orion Platform should install the hotfix release 2020.2.1 HF2, available at customerportal.solarwinds.com.
- GroupSense recommends checking email logs for any suspicious emails from SolarWinds domains dating back to at least Spring 2020.
- While reports indicate that the SUNBURST malware was limited to the Orion platform, GroupSense recommends entities that use SolarWinds’ subsidiary products, including by Pingdom, Papertrail and Loggly, conduct an internal investigation for any indications of compromise.
- We recommend blocking known Indicators of Compromise and monitoring for any indications that organization devices communicated with the actor’s C2 servers.
- Organizations should use the signatures provided by FireEye to identify threat activity, and conduct internal assessments to ensure that the vulnerabilities leveraged by the stolen FireEye red team tools are addressed.
- The same actor behind the SolarWinds Orion compromise previously used a novel technique to bypass Duo multi-factor authentication (MFA), according to research by Volexity. GroupSense recommends that any organizations impacted by the Orion compromise also reset secret keys associated with MFA.
For any further information or questions about the SolarWinds events please contact us at firstname.lastname@example.org, +1-877-469-7226, or by filling out our contact form.