Past the initial phase of dormancy, the undetected digital software “called home” to notify its creator that it had gained access, and was ready to provide access. Based on the expert opinions from the FBI and the Department of Homeland Security, investigations up to this point appear to be directed at grand-scale penetration of the United States Government. The downloaded malware gave the hackers remote access to victims’ networks. As mentioned, the first phases of this cyber-espionage campaign commenced in the spring of 2020. Unfortunately, what they were unaware of was the fact that the update was compromised by an intentionally introduced vulnerability known as ‘ SUNBURST’.Īs we have noted in previous Packetlabs articles, cyber-espionage often involves an element of stealth and equally often, apparent dormancy. It is estimated that 18,000 organizations and governments were impacted by the malicious update. In the spring of 2020, amid the early days of the coronavirus pandemic, a pop-up message displayed across the screens of IT staff, around the globe, using a prevalent software known as Orion, developed by security software firm, SolarWinds’. On a regular basis, we are all encouraged to complete regular software updates to bolster our applications by improving cybersecurity and removing any identified software glitches. They accomplished this after the Solarwinds Breach via injecting malware into a SolarWinds software update. According to the recently compromised global cybersecurity firm, FireEye, suspected state-sponsored hackers have breached the networks of the US Treasury and Commerce departments as part of a global cyberespionage campaign.

Solarwinds orion map maker