The Secure SD-WAN Blog
Posts tagged ‘Solarwinds’
Research Lab
Unpacking the SolarWinds Supply Chain Attack
By Jayesh Gangadas Patel
Senior Threat Analyst, Versa Networks
January 12, 2021
The SolarWinds attack leaves many unanswered questions and the most prominent amongst them is the question of how the attacker entered internal systems of SolarWinds network and was able to infiltrate and move inconspicuously across the development chain. The malware was able to camouflage its activity among the highly secure network of the prominent organization for an extended period of time, evading all their security detection and prevention defenses. In this particular blog, our team will mainly focus on the chain of events that occurred, and the evasive methods employed to remain completely stealthy despite moving around and compromising a highly secure network environment.
Research Lab
SUPERNOVA: the Invisible Explosion That Caught the Industry Off Guard
By Winny Thomas
Principal Security Architect
December 29, 2020
On December 13, 2020, FireEye reported a global campaign that targeted a large sector of industries by threat actors who inserted malicious code within a software component used by the popular network management software SolarWinds. It is not yet known how the threat actors managed to gain access to the development environment in which they added and distributed this malicious code as part of an update to the software. This trojanized version of the dynamic-link library (DLL) has been given the name ‘Sunburst’ by FireEye. Surprisingly enough, researchers have found evidence of the presence of a second backdoor in the SolarWinds product.
Research Lab
The SolarWinds Hack: Understanding SolarStorm’s SUNBURST Backdoor
By Jayesh Gangadas Patel
Senior Threat Analyst, Versa Networks
December 21, 2020
FireEye recently provided information about the widespread attack campaign registered against components of the SolarWinds Orion platform. The SolarWinds Orion platform has a huge customer base of 300,000 clients and issued this advisory on Sunday, December 20th. In this blog post, we will focus on answering specific questions that organizations may have regarding the Solarwinds attack.
