Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The SolarWinds attack illustrates advanced supply chain exploitation via malware hidden within legitimate software updates.
- Actors utilized sophisticated techniques for initial access, persistence, lateral movement, and data exfiltration with minimal detection.
- Understanding the attack’s TTPs is essential for enhancing detection capabilities and response strategies.
Executive Summary
The SolarWinds supply chain attack marked a significant evolution in the landscape of cyber threats, revealing the vulnerabilities inherent in software supply chains. In our analysis of this incident, we recognized that the actor leveraged vulnerabilities and trust relationships in software distribution processes to implant malicious code in legitimate updates. By doing so, they achieved widespread access with minimal detection, affecting numerous high-profile organizations.
Initial Access
During the investigation, we determined that the initial access vector involved the compromise of the SolarWinds Orion platform, a widely-used IT management software. The actor inserted malicious code, known as Sunburst, into the Orion Platform’s software updates. This backdoor was then distributed to thousands of SolarWinds customers, exploiting the inherent trust in software updates. The actor’s meticulous approach underscored an understanding of their target audience and trust relationships in cybersecurity applications.
Execution & Persistence
Upon installation of the compromised update, the Sunburst implant executed and established persistence. We observed that it created a scheduled task within the system, which was configured to call a specific DLL located at C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MyLibrary.dll. This execution path is a significant indicator of the attack and reflects the actor’s intention to renew control after system reboots. Additionally, the implant employed a technique resembling DLL side-loading to enhance its stealth, allowing it to run under the guise of legitimate processes.
Command and Control
The actor established a sophisticated command and control (C2) infrastructure. We analyzed the traffic patterns and identified the use of multiple domain names, which were registered strategically to obfuscate their operations. The C2 communication was carried out using HTTP and HTTPS, leveraging legitimate domains and evading detection mechanisms. During our analysis, we noted that requests to C2 servers included timestamps and identifiers, facilitating further interaction with the implant, which actively beaconed back to the threat actor for further instructions.
Lateral Movement & Discovery
Upon gaining a foothold within the environment, the actor initiated lateral movement to expand the scope of the attack. Leveraging tools and techniques such as Mimikatz for credential dumping, our investigation revealed that they acquired credentials from local systems. This allowed them to pivot to other machines in the network, often targeting Active Directory setups to enumerate and access high-value assets. The use of PSExec and Windows Management Instrumentation (WMI) for remote execution further demonstrates the actor’s capability to move undetected.
Impact & Objectives
The overarching objective of the actor appeared to be data exfiltration and intelligence gathering. Our analysis unveiled that the targeted organizations spanned national security, cybersecurity, and technology sectors, indicating a potential focus on espionage. The data exfiltration was conducted using encrypted channels to obscure the transfer of sensitive information, which could include intellectual property, strategic documents, and user credentials. The ramifications of this attack are far-reaching and exemplify the necessity to scrutinize trusted software sources rigorously.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Utilization of HTTP/S for command and control communication.
- T1059.001 – Command-Line Interface: Using command line for executing malicious scripts or commands.
- T1075 – Pass the Hash: Lateral movement using stolen hashed credentials to authenticate to other machines.
- T1086 – PowerShell: Utilizing PowerShell scripts for execution and control.
Detection Opportunities
- Monitoring for unusual file creations or modifications in
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\for detection of potential implant files. - Implementing network detection rules for known malicious domain patterns and IP address ranges identified during C2 investigation.
- Establishing alerting mechanisms for credential dumping attempts, notably involving processes such as Mimikatz or unusual command-line utilities.
Analyst Notes
This complex attack underscores the need for heightened awareness surrounding supply chain vulnerabilities. Organizations should consider enhancing their software verification processes and implementing multi-factor authentication for critical applications. Continuous monitoring of network traffic and internal behavior analytics are crucial for detecting similar sophisticated threats in the future.
Source: Original Report