Latest Sunburst news

Mimecast: SolarWinds hackers stole some of our source code

Email security company Mimecast has confirmed today that the state-sponsored SolarWinds hackers who breached its network earlier this year used the Sunburst backdoor during the initial intrusion.
- Sergiu Gatlan
- March 16, 2021
- 12:53 PM
- 0
Microsoft shares CodeQL queries to scan code for SolarWinds-like implants

Microsoft has open-sourced CodeQL queries that developers can use to scan source code for malicious implants matching the SolarWinds supply-chain attack.
- Lawrence Abrams
- February 25, 2021
- 01:11 PM
- 0
SolarWinds hackers used 7-Zip code to hide Raindrop Cobalt Strike loader

The ongoing analysis of the SolarWinds supply-chain attack uncovered a fourth malicious tool that researchers call Raindrop and was used for distribution across computers on the victim network.
- Ionut Ilascu
- January 19, 2021
- 02:09 PM
- 0
Sunburst backdoor shares features with Russian APT malware

Kaspersky researchers found that the Sunburst backdoor, the malware deployed during the SolarWinds supply-chain attack, shows shared features with Kazuar, a .NET backdoor tentatively linked to the Russian Turla hacking group.
- Sergiu Gatlan
- January 11, 2021
- 09:07 AM
- 0
SolarWinds hackers had access to over 3,000 US DOJ email accounts

The US Department of Justice said that the attackers behind the SolarWinds supply chain attacks have gained access to roughly 3% of the department's Office 365 email inboxes.
- Sergiu Gatlan
- January 06, 2021
- 02:05 PM
- 0
DHS orders federal agencies to update SolarWinds Orion platform

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered all US federal agencies to update the SolarWinds Orion platform to the latest version by the end of business hours on December 31, 2020.
- Sergiu Gatlan
- December 30, 2020
- 12:18 PM
- 0
Microsoft: SolarWinds hackers' goal was the victims' cloud data

Microsoft says that the end goal of the SolarWinds supply chain compromise was to pivot to the victims' cloud assets after deploying the Sunburst/Solorigate backdoor on their local networks.
- Sergiu Gatlan
- December 29, 2020
- 01:30 PM
- 1
SolarWinds victims revealed after cracking the Sunburst malware DGA

Security researchers have shared lists of organizations where threat actors deployed Sunburst/Solarigate malware, after ongoing investigations of the SolarWinds supply chain attack.
- Sergiu Gatlan
- December 22, 2020
- 09:11 AM
- 3
VMware latest to confirm breach in SolarWinds hacking campaign

VMware is the latest company to confirm that it had its systems breached in the recent SolarWinds attacks and said that the hackers did not make any attempts of further exploitation after gaining access through the deployed backdoor.
- Sergiu Gatlan
- December 21, 2020
- 10:38 AM
- 2
The SolarWinds cyberattack: The hack, the victims, and what we know

Since the SolarWinds supply chain attack was disclosed in December, there has been a whirlwind of news, technical details, and analysis released about the hack. Because the amount of information that was released in such a short time is definitely overwhelming, we have published this as a roundup of SolarWinds news.
- Lawrence Abrams
- December 19, 2020
- 10:10 AM
- 13
FireEye, Microsoft create kill switch for SolarWinds backdoor

Microsoft, FireEye, and GoDaddy have collaborated to create a kill switch for the SolarWinds Sunburst backdoor that forces the malware to terminate itself.
- Lawrence Abrams
- December 16, 2020
- 04:21 PM
- 1