Martin's Blog

8. Discovery and the Killswitch

A campaign engineered for silence (Chapter 4) ran for the better part of fourteen months. It did not end because a vendor’s telemetry caught it, or because a government detected it. It ended because one victim noticed a single odd login. Then, in a fitting turn, the global off switch turned out to be the malware’s own DNS logic, pointed back at itself. This chapter is how the campaign unravelled, and why the killswitch was both elegant and, for the victims who mattered most, beside the point.

8.1 Covering tracks first (June 2020)

Before the discovery, the actor had already cleaned up the factory. Per SolarWinds' investigation (secondary reporting), the SUNBURST injector was removed from the build environment on or about 4 June 2020, after the poisoned builds were long since in the wild. By then the supply-chain stage had done its job: the malicious code no longer needed to be in the pipeline, and leaving it there was only risk.

The asymmetry is the point. Pulling SUNSPOT cleaned the build server, but it did nothing to affected releases already downloaded by an upper bound population of roughly 18,000 customers. Some had installed and beaconed; a smaller subset had received follow-on activity. The factory was clean; the field was not. For six more months active implants could keep resolving their DGA domains and waiting for directives, while the operators worked their hand-picked targets. Removing the injector reduced the actor’s exposure at SolarWinds; it did not reduce the customers’ exposure at all.

8.2 Discovery: one login that didn’t add up (December 2020)

The unravelling began at FireEye, and only because the actor made the mistake of targeting a security company that would notice. Around 8 December 2020, FireEye’s security team got an alert that a new, unrecognized device had been enrolled in multi-factor authentication against an employee’s account. That is a routine-looking event with one fatal problem: the employee hadn’t done it. As CEO Kevin Mandia described it, “We had somebody bypassing our two-factor authentication by registering a new device… but it actually wasn’t our employee.”

That single “severity-zero” alert, an extra second factor enrollment, is what unspooled the entire campaign. It is worth sitting with the irony: the most consequential supply-chain operation on record, with its 12–14-day timers and DGA control plane and EDR-disabling routines, was caught not by any of the defenses it so carefully evaded, but by a help-desk-grade anomaly in an MFA log. Reporting is blunt about the consequence: discovery was a fortunate byproduct. Had the actor not targeted FireEye, or had FireEye not been watching its own MFA enrollments, the dwell time would almost certainly have been longer.

FireEye disclosed its own breach on 8 December 2020 (including the theft of its Red Team tooling), and its responders traced that breach back to its source: a trojanized SolarWinds Orion update. Pulling that thread turned an investigation of one company’s compromise into the discovery of SUNBURST.

8.3 From one breach to a global disclosure

Once FireEye understood it was looking at a poisoned Orion DLL, events moved fast:

Date (2020) Event
8 Dec FireEye discloses its own breach and stolen Red Team tools.
12 Dec FireEye notifies SolarWinds (SolarWinds’ CEO informed this day).
13 Dec Public disclosure: FireEye’s SUNBURST write-up + countermeasures; CISA Emergency Directive 21-01.
14 Dec SolarWinds files an SEC Form 8-K.
15 Dec Killswitch executed (§8.4).

Two of these deserve emphasis. FireEye did not just publish a narrative; it published detection content: YARA rules for SUNBURST and TEARDROP (the $fnv_xor constant from Chapter 4 is one of them), plus the hash set in Indicator_Release_Hashes.csv. That is why, within hours, defenders worldwide could hunt for the exact artifacts dissected in this book. And CISA Emergency Directive 21-01 ordered all federal civilian agencies to disconnect or power down affected Orion versions immediately, an extraordinary step reserved for genuine emergencies, and the start of the response covered in Chapter 10.

8.4 The killswitch: the implant’s own logic, turned around

On 15 December 2020, Microsoft, FireEye, and GoDaddy executed a killswitch, and they did it without an exploit, a patch, or access to a single victim machine. They simply seized avsvmcloud[.]com (the C2 base domain) and repointed it to 20.140.0.1.

To see why that one IP is the whole trick, recall two earlier chapters:

20.140.0.1 falls inside 20.140.0.0/15, one of the implant’s own ImpLink (stand-down) ranges (verified directly: 20.140.0.1 ∈ 20.140.0.0/15). So the killswitch worked like this: every dormant implant that woke and resolved its avsvmcloud[.]com DGA domain now got back an address in its own stand-down range, read it as the directive “disable yourself,” wrote Truncate, and went permanently dark. The defenders did not break SUNBURST; they fed it its own kill signal.

It is hard to overstate how clean this is as a piece of response engineering. The actor had built a permanent self-disable path into the malware, for their operational control, so they could quiet noisy or risky infections. By taking the domain that fed that path, the defenders inherited the control. The most evasive backdoor of its era was switched off using a feature its authors put there themselves.

8.5 What the killswitch did and did not do

The killswitch was decisive for the first stage and nearly irrelevant for the victims who mattered most. The distinction follows directly from the kill chain in Chapters 5 and 6:

This is exactly why CISA’s later guidance (Chapter 10) insisted that patching and the killswitch were not remediation. Disconnecting Orion and letting the DGA die addressed the infection; it did not address the intrusion. Escalated victims faced rebuild-from-clean-media, credential rotation, and re-establishment of federation trust. That was the burden the supply-chain foothold had created and the killswitch could not lift.

8.6 The uncomfortable lessons

Two facts from this chapter sit awkwardly together and are worth stating plainly:

  1. It was found by luck, by a victim. Not by the EDR products SUNBURST listed and disabled (Chapter 4), not by network telemetry that saw only “Orion talking telemetry” (Chapter 5), not by government sensors, but by one security firm noticing one anomalous MFA enrollment. A campaign built to defeat detection was undone by an alert it never tried to defeat.
  2. The off switch existed only because the attacker built one. SUNBURST’s permanent self- disable was a feature for the operators’ convenience; defenders repurposed it into a global killswitch. That worked here, but it is not a defense you can rely on. The next actor need not leave a kill state in its malware, and a stand-down directive does nothing for victims already escalated past the first stage.

The discovery closed the campaign’s active phase. Chapter 10 covers what came next: the attribution already discussed in Chapter 2, sanctions, the emergency response, the landmark SEC case, and the supply-chain policy reckoning.

Sources & evidence

↑ Revisiting the SolarWinds Compromise