Orion solarwinds deleted routes software#
Orion solarwinds deleted routes code#

RAINDROP 3Р’В was reported to have been found elsewhere on a network where there was already a system compromised by SUNBURST. TEARDROP 2Р’В , reported to have been found on some compromised systems via the SUNBURST backdoor, was identified as a dropper (a program whose primary purpose is to deploy and execute an embedded program) that ran in-memory only and was used to deploy a modified version of Cobalt Strike (a full-featured penetration testing application often used for moving laterally through a network and establishing additional backdoors) to the compromised system. Instead, threat actor(s) used the capabilities built into the SUNBURST backdoor to deploy additional malware to their victims. SolarWinds, the company, did not directly deliver or otherwise propagate these second-stage malware executables. Organizations have released public details related to malware used to further compromise systems in environments where there was a version of SolarWinds Orion Platform softwareР’В that included the SUNBURST backdoor.

Orion solarwinds deleted routes software#

It was not included in the compromised SolarWinds Orion Platform software patches or distributed to SolarWindsРІР‚в„ў customers. Notably, the SUNSPOT malware was resident only on SolarWindsРІР‚в„ў Orion Platform software build servers.

Orion solarwinds deleted routes code#

Hence, the codebase remained clean, while the compiled code was signed with the valid SolarWinds software certificate and shipped with the SUNBURST backdoor. At the conclusion of the software build process, SUNSPOT would clean up the temporary source code file to circumvent detection. At build time, SUNSPOT would insert a backdoor ( referred to as SUNBURST)Р’В contained in a temporary source code file used by the compiler.

Working with CrowdStrike to reverse engineer the SUNSPOT malware, it was determined the malware was designed by the threat actor(s) to function solely within the SolarWindsРІР‚в„ў Orion Platform software build environment.Р”Р‡rom our analysis, we determined that the SUNSPOT malware ran in the background on SolarWindsРІР‚в„ў Orion Platform software build servers watching for a new build to take place. SUNSPOT РІР‚вЂњ Attack of the SolarWinds Build ProcessР”Р„s detailed in SolarWindsРІР‚в„ў blog post, KPMG discovered malware РІР‚вЂњ referred to as SUNSPOT РІР‚вЂњ that was deployed for the purpose of covertly inserting a backdoor into the SolarWinds Orion Platform during the software build process. This blog post aims to provide information about the various types of malware that have been discovered, and to and clarify their relationship to the supply chain attack. There has been some confusion regarding the types of downstream malware potentially related to this attack.