Massive Ongoing CyberAttack — the SolarWinds Hack
By: Vishnu Aravindhan
Tags: Microsoft, Cybersecurity, Cybercrime, Security, Crime

This is a devastating cyberattack that has been primarily targeted at the United States government and its agencies. It has also affected several private companies worldwide, including countries such as Belgium, Britain, Canada, Israel, Spain, Mexico, and the UAE. This cyberattack is massive in its scale and impact, and it is a cyberattack that is currently ongoing at this moment. This cyberattack was detected earlier this week by a U.S. based cybersecurity company known as FireEye, and it had labeled this attack as campaign UNC2452. Initial assessments by cybersecurity experts indicate that this is a highly sophisticated attack that has been primarily targeted at the U.S. government and its agencies and departments, and it has also been designed to affect several private companies around the world. By looking at the scale and the extent of this attack, cybersecurity companies and even the U.S. government have labeled this to be a state-sponsored attack. Because to execute a cyberattack of this scale, the attackers would require a very high level of sophistication and access to enormous resources. Usually, they can be possessed only by state agencies or by those attackers in groups who are sponsored by state entities.

New Unique Method of Attack in the Cyber World

Cybersecurity experts believe that this attack might have begun somewhere around March 2020, and it continues to infect computers around the world. And as it is an ongoing attack, the exact extent of damage is still unknown, and the U.S. government and the private organizations that have been affected, they are still carrying out the damage assessment. One thing we should note is that in this cyberattack, the attackers have employed a very unique and novel method to target the computers. Cybersecurity experts are referring to this as a supply chain attack because the malware or the malicious software used by the attackers has not directly focused on the target government agencies and private organizations and instead, it has sought to target third-party vendors who supply essential software to these government entities and private organizations. So since the attack has been routed through the products of third-party vendors, experts are referring to it as a supply chain attack. In this attack, an I.T. management software known as Orion, developed by a US-based company known as Solarwinds, has been targeted, and hence it is being referred to as the Solarwinds Hack.

The I.T Company Solarwinds is a key supplier to several U.S. government departments and private companies, and it has provided them this I.T. management software known as Orion. Generally, cyber attackers try to exploit the vulnerability either in the hardware or the software in order to gain access to the target system. In this case, the attackers are focused upon the vulnerability in the software, a bit of the Orient IT management software. The attackers have basically sent a fake software update notification to the users of the software and the users, that is, the U.S. government agencies and private organizations who believe this to be a genuine software update, they ended up downloading and installing the updates, and they eventually fell prey to this social engineering technique. So once the fake software update was downloaded and installed, it would unleash a hidden malware, which has been named as the Sunburst Malware, thus making it a Trojan type of attack.

Working Of SunBurst Malware

A Trojan or a Trojan horse is a type of malware that is often designed as legitimate software. Trojans can be employed by cyber-thieves and cybercriminals and even by state cyberwarfare agencies in order to gain access to the target systems. The users are usually tricked through a social engineering technique. They’re convinced to download and install a particular program or executable file, which in turn activates the trojan and unleashes malware without the user having any knowledge about this.

Once the malware makes its way into the target system, then it immediately starts functioning in the background and provides backdoor access to the attackers. Once the attacker gets backdoor access, he can remotely control the system; they can even steal sensitive data and modify the data on the computers. And interestingly, the sunburst malware, which was loaded onto the audience software update, has successfully managed to bypass all the firewalls and cybersecurity measures that are put in place and this novel method and the scale and the extent of the attack clearly indicates the high level of sophistication that is needed to design such cyber attacks.

Who is Behind This?

So a few officials of the US government and a few cybersecurity firms are pointing fingers at Russia. They believe that this is a state-sponsored attack either by Russia’s foreign intelligence agency, the SVR, or by its military intelligence JRU, or by the Russia based cyber espionage group known as Fancy Bear, which is known to have connections with Russian intelligence agencies.

Gain Access to Expert View — Subscribe to DDI Intel