Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Supply chain compromise through updated software distribution
- Utilization of Credential Dumping techniques for lateral movement
- Discovery of C2 infrastructure indicating long-term engagement
Executive Summary
In our recent investigation into the SolarWinds supply chain attack, we observed a sophisticated threat actor leveraging existing software update mechanisms to infiltrate a wide range of targets, primarily within the government and IT sectors. The analysis of the malware used, dubbed Sunburst, revealed an extensive and intricate attack vector that utilized advanced techniques to maintain persistence and facilitate data exfiltration.
Initial Access
Our analysis revealed that the initial access vector was established through the compromise of the SolarWinds Orion platform. This was achieved when the actor injected malicious code into legitimate software updates, essentially weaponizing the update process. The infection chain began with the delivery of a trojanized version of the Orion software, which was downloaded and executed by unsuspecting users. During the investigation, we identified that the malicious payload was delivered via the file paths C:\Program Files\SolarWinds\Orion\bin\OrionStudio.exe and C:\Windows\System32\dllhost.exe, wherein it established a foothold on the target systems.
Execution & Persistence
Once executed, Sunburst cleverly employed Registry Run Keys for persistence, specifically creating entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run. This ensured that the implant would survive reboots, maintaining a low profile as it executed its routines seamlessly. The payload then initiated a connection to its command and control (C2) servers, establishing a communication channel that would facilitate further commands from the actor.
Command and Control
The C2 infrastructure was particularly concerning, as our investigation revealed a sophisticated setup using domain generation algorithms (DGA) to obfuscate the source of the communication. The primary C2 domains identified included avsvmcloud[.]com and various subdomains that exhibited a level of operational security designed to evade detection. Traffic logs indicated that the malware was using encryption protocols for data transmission, making it more challenging to analyze the nature of the commands being relayed from the actor to compromised systems.
Lateral Movement & Discovery
Post-infection, we found that the actor employed several techniques, including Credential Dumping via tools like Mimikatz to harvest credentials from memory. This facilitated lateral movement throughout the network, allowing the attacker to pivot to other resources swiftly. The movement methodology was supported by establishing remote procedure calls (RPCs) using legitimate administrative tools such as PsExec and Windows Management Instrumentation (WMI), allowing the implant to spread with relative ease across the organization.
Impact & Objectives
The overall objective of the intrusion appeared to be long-term espionage rather than immediate financial gain. Our findings highlighted significant data exfiltration activities, where sensitive organizational information, including emails and documents, relevant to the targets’ operational capabilities were siphoned off to the malicious actor’s designated C2 servers. This aligns with the characteristics of APT tactics, suggesting that the actor had extensive funding and support, indicative of nation-state backing. The potential impact on affected organizations is severe, as the breach exposed invaluable intellectual property and sensitive communication, increasing the risk of further compromises.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: The malware leveraged HTTPS to communicate with its C2 servers.
- T1003.001 – Credential Dumping: LSASS Memory: Mimikatz was used to extract credentials from system memory.
- T1210 – Exploitation of Vulnerability: Exploitation of vulnerabilities within the SolarWinds Orion platform for initial access.
Detection Opportunities
- Monitor for unexpected outbound connections to known malicious C2 domains, particularly those related to SolarWinds.
- Implement alerts for registry modifications in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunandHKCU\Software\Microsoft\Windows\CurrentVersion\Runthat are not typical for the environment. - Utilize behavioral analytics to identify unusual credential access patterns indicative of Credential Dumping.
Analyst Notes
This investigation underscores the critical need for organizations to maintain vigilance, especially concerning supply chain security. The Sunburst attack is a stark reminder of the sophistication that threat actors can employ, and the potential for widespread impacts. Continuous monitoring and updating of threat detection measures are essential in combating such APT threats, as is fostering a culture of security awareness across all organizational levels.
Source: Original Report