SolarWinds (2020)

Date 	The discovery of an ongoing attack was announced by FireEye on 13 December 2020.FireEye, “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”, 13 December 2020 The malware was supposedly distributed from March to June 2020Solarwinds, “Security Advisory FAQ”, 18 December 2020. and the first infiltrations into the SolarWinds systems were traced to 2019.P H O'Neill, “Recovering from the SolarWinds hack could take 18 months”, 2 March 2021, MIT Technology Review.
Suspected actor	On 15 April 2021, the U.S. and the U.K. attributed the attack to the Russian Foreign Intelligence Service (SVR).United States National Security Agency, “Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities to Compromise U.S. and Allied Networks”, 15 April 2021; United Kingdom Foreign, Commonwealth & Development Office, “Russia: UK exposes Russian involvement in SolarWinds cyber compromise”, 15 April 2021. Russia has denied all allegations, claiming that it “does not conduct offensive operations in the cyber domain”.E Nakashima and C Timberg, “Russian government hackers are behind a broad espionage campaign that has compromised U.S. agencies, including Treasury and Commerce”, 14 December 2020, The Washington Post; see also Reuters, “Russian spy chief denies SolarWinds attack - BBC”, 18 May 2021.
Target 	Clients of SolarWinds, including U.S. government entities as well as private sector organisations. Amongst them were global companies such as Microsoft, Cisco, Intel, Deloitte, and U.S. governmental agencies, such as the Pentagon, the Department of Homeland Security, the State Department, the Department of Energy, the Department of Agriculture, the National Nuclear Security Administration, or the Treasury.I Jibilian and K Canales, “Here's a simple explanation of how the massive SolarWinds hack happened and why it's such a big deal”, 25 February 2021, Business Insider.B Fung, “Biden administration says investigation into SolarWinds hack is likely to take "several months"”, 17 February 2021, CNN.com. The first to notice the breach was the private cybersecurity firm FireEye, also a victim of the hack.
Target systems 	SolarWinds Orion Platform software.
Method 	Supply chain attack. The hackers managed to trojanize the Orion software with backdoor malware SUNBURST. SolarWinds itself unknowingly sent the infected software as an update to its customers from March to June 2020. The malware was instructed to wait up to two weeks and then execute commands enabling transferring files, executing files, profiling the system, rebooting the machines, and disabling system services. Via SUNBURST, the hackers were able to install other malware into the accessed systems, such as the SUPERNOVA malware.SolarWinds, “SolarWinds Security Advisory”, 29 January 2021. To remain unseen, the tools were routinely removed by perpetrators once their goal was achieved.
Purpose 	The campaign possibly aimed at data theft and cyber espionage – against both governmental and non-governmental actors.
Result 	About 18,000 customers of SolarWinds installed the infected updates.Cybersecurity and Infrastructure Security Agency, “Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA)”, 5 January 2021. This resulted in compromised systems, lost integrity and confidentiality of data, and data thefts. With access to networks, hackers may even have destroyed data or stolen identities. Overall, the full scope and impact of the campaign remains unknown.
Aftermath 	According to several analysts, trust in the supply chain was shaken due to the revealed lack of securityB Buchanan, “The Russian hack shows that our problem isn’t technology. It’s whom we trust”, 16 December 2020, The Washington Post.The Linux Foundation, “Preventing Supply Chain Attacks like SolarWinds”, 13 January 2021. The experience may also lead to distrust of updates by consumers, according to Trey Herr, director of Atlantic Council’s Cyber Statecraft Initiative.E Nakashima, “Biden administration preparing to sanction Russia for SolarWinds hacks and the poisoning of an opposition leader”, 23 February 2021, The Washington Post. Furthermore, sanctions are most likely to be put on Russian Federation by the U.S. government. Also, the recovery process will reportedly take up to 18 months and involve substantial effort and investments.
Analysed in 	Scenario 02: Cyber espionage against government departments
Scenario 09: Economic cyber espionage
Collected by: Michaela Prucková
Category:Example
Category:2020
Category:Supply chain