Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The SolarWinds Orion attack facilitated initial access through a deeply integrated supply chain compromise.
- The malware used a sophisticated blend of persistence techniques and modular payloads to maintain a foothold.
- Command and control activity was largely obfuscated, with complex DNS tunneling and HTTP/S communication patterns.
Executive Summary
In late 2020, a significant breach emerged, attributed to a highly skilled actor leveraging the SolarWinds Orion software platform. Our investigation revealed that the actor exploited vulnerabilities in the software supply chain, ultimately infecting thousands of organizations globally. Through our detailed examination of samples and logs, we dissected the attack’s methodology from initial access to lateral movement, outlining the comprehensive obfuscation techniques employed by the malware.
Initial Access
The initial compromise exploited a vulnerability in the SolarWinds Orion platform, specifically through a trojanized update. The sample we analyzed was delivered via an update that was ostensibly legitimate but had been tampered with by the attacker. The infected software was installed in common paths such as C:\Program Files\SolarWinds\Orion, making detection challenging. This initial access phase was critical as it allowed the actor to execute the implant undetected within target environments.
Execution & Persistence
Upon execution, the implant utilized multiple persistence mechanisms, including the modification of the Windows registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Our analysis revealed that the implant created a registry key named SolarWinds.Orion.Core.BusinessLayer to enable automatic execution upon system startup. The actor employed a modular design, allowing the implant to drop additional payloads dynamically based on specific command and control (C2) instructions.
Command and Control
The C2 infrastructure observed was particularly sophisticated, utilizing a combination of DNS tunneling and HTTP/S requests to maintain stealth. The implants communicated with domains like xyz.company.com, which resolved to dynamically changing IP addresses, using a fast-flux network to evade detection. Our investigation identified various timing patterns in the beaconing process, indicative of a well-planned evasion strategy aimed at blending into legitimate traffic.
Lateral Movement & Discovery
Following successful initial access, we observed the actor leveraging built-in Windows tools for lateral movement, such as T1210 – Exploitation of Remote Services. The implant was observed utilizing PsExec and Windows Management Instrumentation (WMI) for executing commands on remote endpoints. Additionally, the actor was able to enumerate network shares, running commands like net use to identify accessible resources across the network, significantly extending their reach within compromised environments.
Impact & Objectives
The ultimate goals of the attacker appeared to be intelligence gathering and data exfiltration. Our analysis indicated that sensitive data was targeted, including credentials and proprietary information from various defense and governmental institutions. The impact extended far beyond immediate data theft; organizations faced crippling operational challenges, necessitating extensive recovery efforts and heightened scrutiny of their security postures.
MITRE ATT&CK Mapping
- T1055 – Process Injection: The implant injected code into legitimate processes to evade detection.
- T1071 – Application Layer Protocol: Command and control traffic utilized common web protocols to blend with typical internet activity.
- T1210 – Exploitation of Remote Services: Utilization of exploits to gain access to additional systems in the network.
Detection Opportunities
- Monitor for unauthorized modifications in the registry, especially under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Implement DNS filtering and inspect DNS queries for any unusual domains or high-frequency lookups.
- Use anomaly detection on network traffic to identify potential C2 activity that mimics legitimate traffic.
Analyst Notes
This incident exemplifies the risks associated with software supply chain vulnerabilities, illustrating the necessity for rigorous monitoring and incident response capabilities within organizations. Continuous vigilance and advance threat hunting methodologies are paramount in identifying and mitigating similar threats in the future.
Source: Original Report