The SolarWinds cyberattack - All you need to know
The SolarWinds cyberattack is the most sophisticated supply chain attack ever
It has impacted several major federal agencies and many more private organizations
Initial discovery
In December 2020, FireEye discovered a supply chain intrusion into some of the SolarWinds products
Alleged Russian attackers had targeted Orion - an infrastructure management platform from SolarWinds
This impacted around 18,000 of customers that were using Orion
Versions 2019.4 HF 5 through 2020.2.1 HF 1 were affected
Attack vectors
Hackers injected malicious code dubbed SUNBURST into the DLL files of Orion’s software updates
Hackers obtained superuser access to SAML token-signing certificates of users
These tokens were used to create forged tokens, enabling privileged access to target networks
In further research, more malware was discovered, including Sunspot, Teardrop, and Raindrop
This is proof of how well-coordinated and complex this attack was
Some suspect that the attackers used a CI/CD tool called Teamcity to gain access to SolarWinds’ supply chain
Teamcity’s parent company Jetbrains is based out of the Czech Republic
It was founded by three Russian engineers
Key Victims
Over 80% of all victims are based in the US
Nine federal agencies and over 100 private companies are said to be directly impacted
Federal agencies compromised include the Department of State, Treasury and Homeland Security, Energy department (including the nuclear weapons agency)
Private organizations affected include Microsoft, Cisco, VMware, FireEye, Mimecast, and many more
Current status
The total financial worth of damage is expected to be several billion dollars
The cost of forensic investigations by cyber insurance vendors alone is expected to be around $90M
The full investigation will take months to be complete
This massive espionage campaign is expected to be just the start of several follow-up attacks in future
Therefore organizations and security professionals need to raise their bar to counter such threats
To know more about cyberattacks and related topics, please visit www.TwainTaylor.com