The cyber security industry is reeling from another large scale, targeted attack. What was initially reported as a breach of FireEye red team tools on December 8th has now been exposed as a much wider, potentially catastrophic breach affecting the SolarWinds Orion software. SolarWinds stated a threat actor inserted malware, SUNBURST or Solorigate, into a service providing trojanized software updates for its Orion platform, used by public and private companies to track IT resources. To date (December 16th, 2020), as many as 18,000 organizations have been affected by SUNBURST, announced SolarWinds. On December 14, Reuters and the Washington Post reported the U.S. Department of Homeland Security (DHS), the State Department, and the National Institutes of Health (NIH) were also compromised as a result of the infected Orion distribution.
Like many in the cyber security community, GroupSense has been hard at work understanding the extent to which our clients may be vulnerable to FireEye’s breached red team tools or impacted by SUNBURST. FireEye reported the stolen red team tools ranged from simple scripts used for automating reconnaissance to entire frameworks similar to publicly available technologies such as CobaltStrike and Metasploit. Thankfully, FireEye quickly published a list of CVEs leveraged by these tools. GroupSense conducted a passive scan of customer-related outward-facing infrastructure for any potential exposure to the vulnerabilities that the stolen FireEye red team tools exploit. We alerted affected customers to these vulnerabilities on December 14.
GroupSense obtained a decoded list of SUNBURST domain generation algorithm (DGA) domains used for command and control (C&C) purposes when exfiltrating data from victim networks. The DGAs were generated by taking the domain of the infected computer and encoding certain information about the domain to generate an assigned value. The assigned value is then utilized to create the URL used as the infected domain’s SUNBURST C&C messaging conduit. All SUNBURST DGAs were created on the avsvmcloud[.]com domain which has been seized and de-weaponized by Microsoft.
SUNBURST domain example: 0bv6kouis4gtgs1be2sd0tdieo0te2h.appsync-api.us-east-2.avsvmcloud[.]com
This example was decoded to: corp.ptci[.]com. GroupSense analysts noticed the maximum amount of characters used to encode was 15. This results in incomplete decoded values where “csnt.princegeor” for example, should at the very least say “princegeorge.” We can't say that the decoded information conclusively means an organization is being targeted or has had any data exfiltrated. The only thing we can say with high confidence is any computer associated with this domain has the SUNBURST malware.
To completely understand SUNBURST, GroupSense has sought information on the threat actors conducting this attack. FireEye originally designated the threat actors as UNC2452, however knowledgeable sources familiar with the investigation told Reuters and the Washington Post the Russian government-backed advanced persistent threat (APT) espionage actor APT29, also known as Cozy Bear, is the likely culprit. APT29 is operated by the Russian Foreign Intelligence Service (SVR). Since its emergence in 2008, the group has targeted government agencies, think tanks, and organizations conducting COVID-19 vaccine research. Known targets of the SUNBURST supply chain attack are consistent with previous targeting patterns by APT29.
For any further information or questions about the SolarWinds events please contact us at sales@groupsense.io, +1-877-469-7226, or by filling out our contact form.