#Solarwinds breach update#
#Solarwinds breach code#

This threat actor has demonstrated sophistication and complex tradecraft in these intrusions. government agencies, critical infrastructure entities, and private sector organizations by an APT actor.

AR21-105A: MAR-10327841-1.v1 – SUNSHUTTLEĬISA is aware of compromises, which began at least as early as March 2020, at U.S.

(Updated April 15, 2021) See the following Malware Analysis Reports (MARs) for additional technical details and associated IOCs: ( Updated January 8, 2021) For a downloadable list of indicators of compromise (IOCs), see the STIX file.

Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans.

Not all organizations that have the backdoor delivered through SolarWinds Orion have been targeted by the adversary with follow-on actions.

CISA is investigating other initial access vectors in addition to the SolarWinds Orion supply chain compromise.

This is a patient, well-resourced, and focused adversary that has sustained long duration activity on victim networks.

Key Takeaways ( updated December 18, 2020) CISA advises stakeholders to read this Alert and review the enclosed indicators (see Appendix B). Note: this Activity Alert does not supersede the requirements of ED 21-01 or any supplemental guidance and does not represent formal guidance to federal agencies under ED 21-01.ĬISA has determined that this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations. CISA has subsequently issued supplemental guidance to Emergency Directive (ED) 21-01, most recently on January 6, 2021.

#Solarwinds breach code#

( Updated January 6, 2021): On December 13, 2020, CISA released Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise, ordering federal civilian executive branch departments and agencies to disconnect affected devices. Refer to /supply-chain-compromise for additional resources.

#Solarwinds breach update#

CISA will update this Alert as new information becomes available. CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs).

Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary’s behavior is present, yet where impacted SolarWinds instances have not been identified. Note ( updated January 6, 2021): CISA has evidence that there are initial access vectors other than the SolarWinds Orion platform and has identified legitimate account abuse as one of these vectors (for details refer to Initial Access Vectors section). For clarity, the Alert now lists these platform versions that share the same DLL version number separately, as both are considered affected versions. Note: prior versions of this Alert included a single bullet that listed two platform versions for the same DLL. ( Updated January 6, 2021): One of the initial access vectors for this activity is a supply chain compromise of a Dynamic Link Library (DLL) in the following SolarWinds Orion products (see Appendix A).

CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations. This APT actor has demonstrated patience, operational security, and complex tradecraft in these intrusions. government agencies, critical infrastructure entities, and private sector organizations by an advanced persistent threat (APT) actor beginning in at least March 2020. The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises of U.S. For more information on SolarWinds-related activity, go to and. Additional information may be found in a statement from the White House. Government attributes this activity to the Russian Foreign Intelligence Service (SVR).