The Cybersecurity and Infrastructure Security Agency (CISA) has released an official alert warning that experienced hackers are currently exploiting SolarWinds Orion IT monitoring and management software.
The cyberattack is thought to be the work of a highly complex, evasive, nation state hacking group who invented a Trojanized strain of Orion software that has been used to deploy a backdoor into customers’ systems labelled SUNBURST.
The supply chain attack has affected approximately 18,000 customers, who are thought to have installed the Trojanized version of SolarWinds Orion and the SUNBURST backdoor. SolarWinds Orion is used by large public and private groups and government bodies.
SolarWinds customers incorporate all five branches of the U.S. military, the Pentagon, State Department, NASA and National Security Agency. Its solutions are also implemented by 425 of the 500 largest publicly traded U.S. firms. The US Treasury, US National Telecommunications and Information Administration (NTIA), and Department of Homeland Security are known to have been targeted. The campaign was first discovered by the cybersecurity company FireEye, which was also attacked as part of this attack.
The attacks began during spring 2020 when the first malicious versions of the Orion software were launched. The hackers are thought to have been active in compromised networks since that time. The malware is evasive, which is why it has taken so long to discover the threat. FireEye commented: “The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity”. Once the backdoor has been put in place, the hackers move laterally and steal data.
Kevin Thompson, SolarWinds President and CEO said: “We believe that this vulnerability is the result of a highly-sophisticated, targeted, and manual supply chain attack by a nation-state”.
The hackers obtained access to SolarWinds’ software development environment and placed the backdoor code into its library in SolarWinds Orion Platform software versions 2019.4 HF 5 through 2020.2.1 HF 1, which were made public between March 2020 and June 2020.
CISA released an Emergency Directive ordering all federal civilian bodies to take swift action to block any attack in progress by immediately unlinking or powering down SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1, from their networks. The agencies have also been forbidden from “(re)joining the Windows host OS to the enterprise domain.”
All users have been told to immediately upgrade their SolarWinds Orion software to Orion Platform version 2020.2.1 HF 1. A subsequent hotfix – 2020.2.1 HF 2 – is due to be released on Tuesday and will replace the compromised component and implement other additional security measures.
If it is not possible to quickly upgrade, guidelines have been made available by SolarWinds for securing the Orion Platform. Organizations should also scan for signs of compromise. The signatures of the backdoor are being included on antivirus engines, and Microsoft has confirmed that all its antivirus products now detect the backdoor and users have been advised to complete a full scan.
SolarWinds is working alongside FireEye, the Federal Bureau of Investigation, and the intelligence community to investigate the hacking attempts. SolarWinds is also working with Microsoft to remove an attack vector that results in the compromise of targets’ Microsoft Office 365 productivity tools.
It is currently not known which group is to blame for the attack; although the Washington Post claims to have contacted sources who confirmed the attack was the work of the Russian nation state hacking group APT29 (Cozy Bear). An official representative for the Kremlin said Russia had nothing to do with the attacks, saying “Russia does not conduct offensive operations in the cyber domain.”