ICS / nation-stateATT&CK S0559
SUNBURST
Also known as: Solorigate
SUNBURST was a backdoor hidden inside legitimate, digitally signed updates of SolarWinds Orion network-management software in 2020. Many organisations installed the trojanised updates; the attackers then chose a much smaller set of high-value targets, including US government agencies, for follow-on intrusions. CISA issued an emergency directive ordering federal agencies to disconnect affected Orion products.
- Public attribution and associated actors
- In April 2021 the US government formally named Russia's Foreign Intelligence Service (SVR) as the perpetrator of the SolarWinds Orion compromise; MITRE ATT&CK lists SUNBURST as used by APT29.As publicly reported:APT29
- First seen
- 2020
- Platforms
- Windows (SolarWinds Orion)
- MITRE ATT&CK software entries
- S0559 SUNBURST
How it spreads or gets in
- Distributed through the vendor's own build and update process, so victims installed it as a normal software update.
Key behaviours
- Stayed dormant for a period after installation before calling out.
- Checked for security tools and analysis environments and stopped if found.
- Blended its command traffic into normal-looking Orion and DNS traffic.
ATT&CK techniques
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain
- T1553.002Subvert Trust Controls: Code Signing
- T1036.005Masquerading: Match Legitimate Resource Name or Location
- T1497.003Virtualization/Sandbox Evasion: Time Based Checks
- T1518.001Software Discovery: Security Software Discovery
- T1071.004Application Layer Protocol: DNS
- T1568Dynamic Resolution
- T1001.003Data Obfuscation: Protocol or Service Impersonation
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Baseline network-management servers and alert on any new outbound destinations.
- Monitor identity systems for forged tokens and new federation trusts.
- Hunt for unusual DNS patterns from infrastructure servers.
Defences that work
- Restrict internet egress from management servers to what they genuinely need.
- Assess supplier build security (SBOMs, reproducible builds, signing controls).
- Protect identity infrastructure and token-signing keys as tier-0 assets.