2020Supply chainEspionage
SolarWinds Orion supply-chain compromise
Disclosed December 2020
Attackers inserted the SUNBURST backdoor into the build process for SolarWinds Orion, so customers received it inside legitimate, signed software updates. They then picked a smaller number of high-value victims for deeper intrusion, often moving into cloud identity systems. CISA issued an emergency directive ordering federal agencies to disconnect affected Orion products.
- Victim
- SolarWinds customers, including US government agencies
- Sector
- Government and technology
- Public attribution
- In April 2021 the US government formally named Russia's Foreign Intelligence Service (SVR) as the perpetrator.APT29 profile
- Malware
- SUNBURST
Impact
Compromise of multiple US federal agencies and private-sector organisations (CISA, White House).
Root cause
A compromised software build environment at a trusted vendor, and broad network access granted to management software inside customer networks.
Lessons learned: the controls it teaches
- Secure the software build pipeline and verify what is shipped (SBOMs, signing controls).
- Restrict outbound access from management servers to what they need.
- Protect identity infrastructure and token-signing keys as tier-0 assets.
Related exams
Sources
- CISA AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
- CISA ED 21-01: Mitigate SolarWinds Orion Code Compromise
- The White House (archived): Fact sheet on imposing costs for harmful foreign activities by the Russian government