Visual Notes : SolarWinds Supply Chain compromise using SUNBURST backdoor (detected by FireEye)

Visual Notes : SolarWinds Supply Chain compromise using SUNBURST backdoor (detected by FireEye)

First, let me be clear that I have no insider knowledge. This is my best guess at what occurred, based on publicly available information here (FireEye) and others indicated in references section below.

FireEye discovered the supply chain attack that trojanized SolarWinds Orion business software updates in order to distribute malware they call SUNBURST. This report is a must read to understand details associated to this incident.

Locations of DLL

IOC — (Indicator of Compromise) to hunt in DNS logs + full PCAP

• DGA generated C2 Domain : avsvmcloud[.]com
  Understanding Domain Generation Algorithms (DGA)
• C2 domain for malware to connect to, retrieved via CNAME from DGA-generated C2
  freescanonline[.]com
  deftsecurity[.]com
  thedoccloud[.]com
  websitetheme[.]com
  highdatabase[.]com
  incomeupdate[.]com
  databasegalore[.]com
  panhardware[.]com
  Zupertech[.]com
  Virtualdataserver[.]com
  digitalcollege[.]org
• Malicious DLL (SolarWinds.Orion.Core.BusinessLayer.dll) beacons out to C2 infra (as indicated below) to get additional payloads and commands (backdoor)

FireEye notes that if the malware resolves the domain to a private IP address, it will not execute.

Command data is spread across multiple strings that are disguised as GUID and HEX strings.

 — @KyleHanslovan

References

• FireEye Advisory : https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
• Jake Williams tweet stream : https://twitter.com/MalwareJake/status/1338641921846239232
• Kyle Hanslovan / DLL Locations https://gist.github.com/KyleHanslovan/0c8a491104cc55d6e4bd9bff7214a99e
• Decompile of the SolarWinds “SUNBURST” Trojan associated with Campaign UNC2452 (for those interested in RE’ing or Static Code Analysis) https://github.com/Shadow0ps/solorigate_sample_source/tree/main
• Play by Play tweet stream analyzing decompiled source code https://twitter.com/Shadow0pz/status/1338616137001693184

Sponsorships Available

Sponsorships Available

Sponsorships Available

Visual Notes : SolarWinds Supply Chain compromise using SUNBURST backdoor (detected by FireEye) was originally published in ShiftLeft Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Recent Articles By Author

• The Optus Breach: How Bad Code Keeps Happening to Good Companies
• Log4Shell : JNDI Injection via Attackable Log4J
• Evolving Threat series — Infiltrating NPM’s Supply Chain (UA-Parser-js)

More from Chetan Conikee

*** This is a Security Bloggers Network syndicated blog from ShiftLeft Blog - Medium authored by Chetan Conikee. Read the original post at: https://blog.shiftleft.io/visual-notes-solarwinds-supply-chain-compromise-using-sunburst-backdoor-detected-by-fireeye-561e097fff3c?source=rss----86a4f941c7da---4