Hot Topics

avsvmcloud.com

SolarWinds Backdoor State Diagram

Targeting Process for the SolarWinds Backdoor

| | avsvmcloud.com, backdoor, C2, CNAME, dns, fireeye, Microsoft, SolarWinds, Solorigate, Stage 2, STAGE2, SUNBURST, targeted
The SolarWinds Orion backdoor, known as SUNBURST or Solorigate, has been analyzed by numerous experts from Microsoft, FireEye and several anti-virus vendors. However, we have noticed that many of the published reports ...
NETRESEC Network Security Blog
23 SUNBURST Targets Identified

Twenty-three SUNBURST Targets Identified

| | avsvmcloud.com, CERT-SE, CNAME, dns, fireeye, Microsoft, Passive DNS, pDNS, SecureList, SolarWinds, Solorigate, STAGE2, SUNBURST, VriesHd
Remember when Igor Kuznetsov and Costin Raiu announced that two of the victims in FireEye's SUNBURST IOC list were ***net.***.com and central.***.gov on Kaspersky's Securelist blog in December? Reuters later reported that ...
NETRESEC Network Security Blog
Were you targeted by SUNBURST? Image credit: NASA

Robust Indicators of Compromise for SUNBURST

| | 22334A7227544B1E, avsvmcloud, avsvmcloud.com, CNAME, Cobalt Strike, dns, Indicators, IOC, NetBIOS, Palo Alto, paloaltonetworks, SolarStorm, SolarWinds, STAGE2, SUNBURST
There has been a great deal of confusion regarding what network based Indicators of Compromise (IOC) SolarWinds Orion customers can use to self assess whether or not they have been targeted after ...
NETRESEC Network Security Blog