Revisiting the SolarWinds Compromise
This book revisits the SolarWinds compromise and provides a technical, chronological account of the campaign, built from public reports and a reverse-engineering archive containing the analyzed artifacts: the four SolarWinds Orion installers (one benign trial build and three weaponized), the companion second-stage and later-stage samples, and the passive DNS captures of the C2 fabric. Reverse-engineering claims are tied to those analyzed artifacts; historical, attribution, product configuration, and policy claims are tied to the public sources listed in each chapter.
How to read this book
The ten chapters follow the campaign in time: initial access, the dry run, the injector, the backdoor, distribution, the second stage, discovery, and the aftermath. An epilogue then steps outside that chronology to examine the product design decision that amplified the potential impact. The depth is aimed at a technical practitioner reader (RE / SOC / IR): the malware chapters reproduce the real decompiled C# and IDA/Hex-Rays pseudocode and walk it line by line.
A note on evidence and provenance. This book keeps two kinds of claim distinct throughout:
- Locally verified: recovered directly from the artifacts here by hashing, decompiling, decoding obfuscated constants, or parsing passive DNS (e.g. compile timestamps, the backdoor logic, DGA victim decodes, and privileged registry/service operations). These artifacts do not independently prove Orion’s default service account or that each privileged operation succeeded.
- Vendor-documented / cited: facts from public reporting, cited and not derived here. Two recur often and are always flagged: the poisoned DLLs' valid Authenticode signature is vendor-documented (Authenticode verification was unavailable during analysis), Orion’s documented default service account was LocalSystem, and the day-level 2019 dates are secondary reporting. The actor chapter (2) and policy chapter (10) are cited reporting, marked as such.
External network indicators are defanged in prose (avsvmcloud[.]com,
reyweb[.]com). File hashes are given verbatim.
Table of contents
| # | Chapter | What it covers |
|---|---|---|
| 1 | The Incident and Its Impact | What happened in one paragraph; why scale + trust + patience made it a watershed; the cast of malware families; the evidence base. |
| 2 | The Threat Actor | SVR / APT29 and the name soup (UNC2452 / StellarParticle / NOBELIUM / Dark Halo); confidence and cumulative attribution; what the code says about the operator; the SUPERNOVA boundary. |
| 3 | Compromising SolarWinds: The Skeleton and the Backdoor | Initial access gap; the empty-stub dry run; SUNSPOT the build injector; the 12-line trigger; the first weaponized release. |
| 4 | SUNBURST Anatomy: Gates, DGA, and C2 | The deobfuscation primitives; activation gates; ProcessTracker and the 188-unique value blocklist; the DGA/DNS layer; the HTTP C2 protocol; the JobEngine command set. |
| 5 | Mass Distribution and Victimology | The full installers and CAB manifests; the passive DNS C2 fabric; the range-as-directive finding (94.8% of unique IPs in the sample); the decoded beacon observations. |
| 6 | Hands-on-Keyboard: The Second Stage | The kill chain; TEARDROP and RAINDROP loading Cobalt Strike BEACON; what “memory-only” means; and the cited cloud/identity tradecraft (Golden SAML, mail theft). |
| 7 | An Interlude: The Second, Unrelated Intruder | SUPERNOVA, publicly reported Orion exploitation including CVE-2020-10148, the DynamicRun webshell, and why “same product” is not “same actor.” |
| 8 | Discovery and the Killswitch | The FireEye MFA enrollment discovery; the disclosure cascade; the killswitch that turned SUNBURST’s own DNS logic against it; and what it couldn’t fix. |
| 9 | Later Tooling and Attribution | GoldFinder, SIBOT, GoldMax/SUNSHUTTLE with annotated code; per-build rotation; why string IOCs age and code/behaviour endure. |
| 10 | Response, Consequences, and Policy Legacy | CISA ED 21-01; sanctions and expulsions; the landmark SEC v. SolarWinds & Brown case; EO 14028 and its later implementation changes. |
| Epi. | Epilogue: The Privilege Multiplier — Orion as LocalSystem | The documented service account default, the implant’s privileged operations, the exposure-≠-use discipline, and a least-privilege counterfactual. |
| App. | Appendix: Timeline, IOCs, and Artifact Map | Master timeline, consolidated indicators, the 22 nList signalling ranges, and an evidence → section map. |
Conventions
- Code blocks are real decompiled output (ILSpy C#, IDA Hex-Rays, or the decoded SIBOT script), lightly trimmed for length; each is followed by a line-by-line walkthrough.
- One SUNBURST. The backdoor class is byte-for-byte identical across the
three weaponized builds; snippets are taken from the
9083decompilation and apply to all three. - Cross-references use Hugo
relreflinks, so they remain correct if the site base URL changes.