Monitoring deep, dark and surface web to detect exposure of your sensitive data, secret projects and initiatives, privileged users, critical systems, IT infrastructure, and more.
Monitoring and alerting of third party data breaches impacting your employees’ emails, usernames, and personally identifiable information.
Assess the risk footprint and security posture of key business relationships to get a handle on external risk introduced through your extended attack surface.

Sign Up for Updates
Digital risk monitoring of key personnel with telemetry and risk metrics. VIPRecon provides broad coverage of social media, deep and dark web, as well as physical threat assessments.
Our Ransomware Response Readiness Assessment, Playbook and Table Top Exercise gives your organization the best chance to survive and recover.
Gain visibility of your digital footprint by reaching into the most active areas of the cyber underground.
Fully managed and tailored Threat Intelligence services that becomes an extension of your current security processes and provides real-time visibility on new threats.
Providing research and investigations into known threats, to save security teams time and stress during a cyber emergency.

Sign Up for Updates
GroupSense offers a comprehensive package of services for assessing and responding to ransomware attacks, including negotiations with threat actors.
Actively researching and monitoring threats from vendors or third-party companies that can affect organizational security.
Monitoring for threats to elections, VIPs, and more on social media to proactively prevent or mitigate digital risk.
Focusing on the threats and risks that matter to your security processes and providing intelligence and insights to prevent or mitigate digital risk.
Taking the next step in security services, by proactively taking down phishing sites or anonymously interacting with threat actors to provide better intelligence.
Active monitoring of your brand's digital assets to protect its reputation and stop further brand abuse from targeting unsuspecting victims.

Sign Up for Updates
Combining your cyber and fraud programs to effectively fight threat actors continually scamming or threatening assets within an organization.
Executives are prime targets for fraudulent activities, but with a proactive approach, any attacks or threats can be neutralized before causing any damage.
Governments, political parties and candidates must all act now to activate cyber threat intelligence services to harden their information security and get ahead of inevitable cyber threats to the election process.
4 min read

Overview of the SolarWinds Software Supply Chain Attack

Dec 17, 2020 1:39:15 PM

Background

The cyber security industry is reeling from another large scale, targeted attack. What was initially reported as a breach of FireEye red team tools on December 8th has now been exposed as a much wider, potentially catastrophic breach affecting the SolarWinds Orion software. SolarWinds stated a threat actor inserted malware,  SUNBURST or Solorigate, into a service providing trojanized software updates for its Orion platform, used by public and private companies to track IT resources. To date (December 16th, 2020), as many as 18,000 organizations have been affected by SUNBURST, announced SolarWinds. On December 14, Reuters and the Washington Post reported the U.S. Department of Homeland Security (DHS), the State Department, and the National Institutes of Health (NIH) were also compromised as a result of the infected Orion distribution.

GroupSense Findings

Like many in the cyber security community, GroupSense has been hard at work understanding the extent to which our clients may be vulnerable to FireEye’s breached red team tools or impacted by SUNBURST. FireEye reported the stolen red team tools ranged from simple scripts used for automating reconnaissance to entire frameworks similar to publicly available technologies such as CobaltStrike and Metasploit. Thankfully, FireEye quickly published a list of CVEs leveraged by these tools. GroupSense conducted a passive scan of customer-related outward-facing infrastructure for any potential exposure to the vulnerabilities that the stolen FireEye red team tools exploit. We alerted affected customers to these vulnerabilities on December 14.

GroupSense obtained a decoded list of SUNBURST domain generation algorithm (DGA) domains used for command and control (C&C) purposes when exfiltrating data from victim networks. The DGAs were generated by taking the domain of the infected computer and encoding certain information about the domain to generate an assigned value. The assigned value is then utilized to create the URL used as the infected domain’s SUNBURST C&C messaging conduit. All SUNBURST DGAs were created on the avsvmcloud[.]com domain which has been seized and de-weaponized by Microsoft. 

SUNBURST domain example: 0bv6kouis4gtgs1be2sd0tdieo0te2h.appsync-api.us-east-2.avsvmcloud[.]com

This example was decoded to: corp.ptci[.]com. GroupSense analysts noticed the maximum amount of characters used to encode was 15. This results in incomplete decoded values where  “csnt.princegeor” for example, should at the very least say “princegeorge.” We can't say that the decoded information conclusively means an organization is being targeted or has had any data exfiltrated. The only thing we can say with high confidence is any computer associated with this domain has the SUNBURST malware.

To completely understand SUNBURST, GroupSense has sought information on the threat actors conducting this attack. FireEye originally designated the threat actors as UNC2452, however knowledgeable sources familiar with the investigation told Reuters and the Washington Post the Russian government-backed advanced persistent threat (APT) espionage actor APT29, also known as Cozy Bear, is the likely culprit. APT29 is operated by the Russian Foreign Intelligence Service (SVR). Since its emergence in 2008, the group has targeted government agencies, think tanks, and organizations conducting COVID-19 vaccine research. Known targets of the SUNBURST supply chain attack are consistent with previous targeting patterns by APT29.

Recommendations

  • Organizations that use the SolarWinds Orion Platform should install the hotfix release 2020.2.1 HF2, available at customerportal.solarwinds.com.
  • GroupSense recommends checking email logs for any suspicious emails from SolarWinds domains dating back to at least Spring 2020.
  • While reports indicate that the SUNBURST malware was limited to the Orion platform, GroupSense recommends entities that use SolarWinds’ subsidiary products, including by Pingdom, Papertrail and Loggly, conduct an internal investigation for any indications of compromise.
  • We recommend blocking known Indicators of Compromise and monitoring for any indications that organization devices communicated with the actor’s C2 servers.
  • Organizations should use the signatures provided by FireEye to identify threat activity, and conduct internal assessments to ensure that the vulnerabilities leveraged by the stolen FireEye red team tools are addressed.
  • The same actor behind the SolarWinds Orion compromise previously used a novel technique to bypass Duo multi-factor authentication (MFA), according to research by Volexity. GroupSense recommends that any organizations impacted by the Orion compromise also reset secret keys associated with MFA.

For any further information or questions about the SolarWinds events please contact us at sales@groupsense.io, +1-877-469-7226, or by filling out our contact form.
Topics: Blog
Editorial Team

Written by Editorial Team

Featured

cyber-tips