The Hack Roundup: SolarWinds Shares Details on How Attackers Inserted Backdoor

SolarWinds released details and a new timeline for how attackers compromised its Orion product, which government agencies and private-sector companies are still attempting to remediate.

The company, with help from KPMG and Crowdstrike, discovered “highly sophisticated and novel code” that injected the Sunburst malware into Orion products, according to a Jan. 11 blog post from SolarWinds President and Chief Executive Officer Sudhakar Ramakrishna, who joined the company this month.

The injection code—which CrowdStrike is calling Sunspot—inserts Sunburst into software builds by replacing a source file. CrowdStrike said the attackers took safeguards to make sure to stay off the SolarWinds developers’ radar. (For more technical details, read CrowdStrike’s post.)

SolarWinds’s new timeline of events now starts in September 2019, when the attacker accessed and tested code. The Sunburst malware—aka the backdoor—was deployed in February 2020—a month earlier than previous reports. SolarWinds was notified of Sunburst Dec. 12.

“We recognize the software development and build process used by SolarWinds is common throughout the software industry, so we believe that sharing this information openly will help the industry guard against similar attacks in the future and create safer environments for customers,” Ramakrishna wrote. 

So it’s Russia, right? The federal government's response group—the Cyber Unified Coordination Group—previously said Russia was “likely” behind what it believes is a widespread intelligence-gathering campaign. SolarWinds’s blog acknowledges UCG’s statement, but said its team has yet to independently verify who the attackers are. CrowdStrike’s technical analysis also does not attribute the Sunspot, Sunburst or the post-exploitation tool called Teardrop to known adversaries and is tracking the activity as “StellarParticle.”

On Monday, security researchers with Kaspersky published a blog detailing “several features that overlap with a previously identified backdoor known as Kazuar,” which was first identified by Palo Alto researchers in 2017.

Kaspersky researchers—and others, like Palo Alto—note the Kazuar tool is often used by Russian advanced persistent threat, or APT, group Turla.

“We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about Kazuar and the origin of Sunburst, the malware used in the SolarWinds breach,” the Kaspersky blog states.

Kaspersky researchers also warned the similarities could be a possible false flag to shift blame to a different group.

The Cybersecurity and Infrastructure Security Agency issued a new alert Friday broadening the known threat to include intrusions into Microsoft 365 and the Azure cloud environment without the use of malware implanted in SolarWinds.

While initial alerts from CISA focused on compromises through the SolarWinds Orion product, the latest update details how hackers were able to gain direct access to Microsoft cloud environments without using the SolarWinds backdoor, including password spraying or brute force attempts, or using unsecured administrator credentials.  

“This level of compromise is challenging to remediate and requires a rigorous multi-disciplinary effort to regain administrative control before recovering,” CISA officials added.

The latest alert includes remediation tactics and various tools—including CISA-built, vendor-built and open source—organizations can use to identify compromised environments.

Meanwhile, President-elect Joe Biden is adding officials with cyber cred to his administration. Caitlin Durkovich, who previously served as chief of staff at the National Protection and Programs Directorate, will serve as the National Security Council’s senior adviser for resilience and response. Lisa Monaco, former homeland security adviser to President Barack Obama, will be deputy attorney general. Politico reported the Biden team wants Anne Neuberger, director of the National Security Agency’s Cybersecurity Directorate, for a deputy national security adviser for cybersecurity, though the transition team has not made any official announcements. 

Acting Homeland Security Secretary Chad Wolf resigned Monday citing recent events, though a federal judge ruled his appointment was unlawful back in November. It’s just more turnover at an agency that has struggled with consistent leadership throughout the administration—and that includes CISA. Brandon Wales has been serving as acting CISA director since November when President Donald Trump fired Chris Krebs and some other officials resigned. 

Krebs, who continues to make appearances challenging Trump’s claims of an insecure election, recently announced he will partner with former Facebook security officer and Stanford Internet Observatory founder Alex Stamos for a cyber consultancy called the Krebs Stamos Group. The group has already been hired by SolarWinds, according to a Reuters report.

Who says all trolling takes place online? Reuters reported the FBI is looking into a postcard sent to FireEye’s CEO Kevin Mandia that questions the company’s ability to attribute cyber activity to Russia. The report says the investigation is looking at whether people associated with a Russian intelligence service may have sent it. In early December, FireEye announced it was hacked and its red team tools stolen by a “nation with top-tier offensive capabilities,” days before news of the SolarWinds vulnerability broke.