Revisiting the SolarWinds Compromise on Martin's Blog

The Incident and Its Impact

Mon, 01 Jan 0001 00:00:00 +0000

The supply chain is the soft underbelly of the software industry. An attacker does not need to break into eighteen thousand networks one by one if a trusted update channel can carry the same backdoor into all of them.

1.1 What happened, in one paragraph

Between September 2019 and December 2020, an intelligence service later identified as Russia’s SVR (tracked across the incident as APT29 / Cozy Bear, and under the investigation handles UNC2452 / StellarParticle / NOBELIUM / Solorigate) ran one of the most consequential supply-chain operations on record. They did not break into their targets one by one. Instead they got inside SolarWinds, a Texas company whose Orion network monitoring platform sits, by design, at the privileged center of tens of thousands of enterprise and government networks. They used a bespoke build server implant (SUNSPOT) to quietly weld a backdoor (SUNBURST) into a single Orion assembly, SolarWinds.Orion.Core.BusinessLayer.dll, as Orion was being compiled. Because the tampering happened before code signing, every poisoned build shipped with what vendors documented as a valid SolarWinds Authenticode signature and flowed out through the normal update channel to an upper bound population of ~18,000 potentially affected customers. SolarWinds later clarified that this download-based estimate included customers that did not install the update or whose servers could not reach the internet. A much smaller, selected subset was exploited hands-on.

The Threat Actor

Mon, 01 Jan 0001 00:00:00 +0000

A note on what this chapter can and cannot prove. No binary names its author. Nothing in the four installers or the companion samples examined for this book establishes a nationality, a sponsor, or a building in Moscow. Nation-state attribution is a separate discipline that rests on the broader investigation, infrastructure correlation, victim pattern of life, and intelligence sources that vendors do not publish, and ultimately on a government’s decision to say so on the record. This chapter therefore draws on the public record (cited), and is honest about the seam between what the code shows (§2.4 and the artifact comparisons in §2.3) and who the public record says built it. The strongest analytic statement is not that any one fact proves identity; it is that the case is cumulative, and that the convergence is now very strong.

Compromising SolarWinds: The Skeleton and the Backdoor

Mon, 01 Jan 0001 00:00:00 +0000

The popular telling of SolarWinds collapses into a single sentence: “they hid a backdoor in an update.” The reality is more disciplined and, for a reverse-engineer, more interesting. The actor did not insert a backdoor and hope. They ran a rehearsal, shipping an empty backdoor class in a real, signed release months before the real one, purely to learn whether tampered code could ride the SolarWinds build pipeline unnoticed. Only once that succeeded did they build the machine, SUNSPOT, that welded the working backdoor into Orion at compile time, then quietly restored the clean source so nobody at SolarWinds would see a thing.

SUNBURST Anatomy: Gates, DGA, and C2

Mon, 01 Jan 0001 00:00:00 +0000

This is the chapter the rest of the book points at. The previous chapter showed how a 3,346-line class named OrionImprovementBusinessLayer got compiled into a signed Orion DLL and launched from a twelve-line trigger. Here we read that class.

One fact frames everything. Decompiling the implant from all three weaponized builds and diffing the backdoor class shows that its decompiled source is byte-for-byte identical across 2019.4.5200.9083, 2020.2.5200.12394, and 2020.2.5300.12432:

Comparing OrionImprovementBusinessLayer.cs across the three builds produces no differences.

Mass Distribution and Victimology

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 4 explained how SUNBURST encodes a victim’s identity into a DNS name and how the range of the DNS answer issues a go / stand-down / kill directive. This chapter is the evidence for that mechanism, and the answer to “who was actually beaconing.” It moves from the decompiled implant to three bodies of evidence examined for this book: the full installers that carried the backdoor through the legitimate update channel, the passive DNS record of the C2 fabric, and the decoded beacon observations recovered by reversing the DGA.

Hands-on-Keyboard: The Second Stage

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 5 ended at the funnel: up to roughly 18,000 potentially affected customers, the DNS control plane observed in passive DNS, and a much smaller publicly documented set receiving hands-on follow-on activity. SUNBURST was only ever the door. For selected targets, the operators came through it by hand, and that is where a supply-chain infection became a real intrusion.

This chapter has two layers, and the line between them matters:

An Interlude: The Second, Unrelated Intruder

Mon, 01 Jan 0001 00:00:00 +0000

Every account of SolarWinds eventually trips over SUPERNOVA, and most accounts trip badly by folding it into the SUNBURST campaign because it lived on the same product. It does not belong there. SUPERNOVA is a different piece of malware, delivered a different way, by a different actor, and happened to target Orion in the same window. This short chapter exists precisely to draw that line cleanly, because “same product, therefore same attacker” is the single most common analytical error around this incident (Chapter 2, §2.3).

Discovery and the Killswitch

Mon, 01 Jan 0001 00:00:00 +0000

A campaign engineered for silence (Chapter 4) ran for the better part of fourteen months. It did not end because a vendor’s telemetry caught it, or because a government detected it. It ended because one victim noticed a single odd login. Then, in a fitting turn, the global off switch turned out to be the malware’s own DNS logic, pointed back at itself. This chapter is how the campaign unravelled, and why the killswitch was both elegant and, for the victims who mattered most, beside the point.

Later Tooling and Attribution

Mon, 01 Jan 0001 00:00:00 +0000

Disclosure did not end the actor. Through 2021 the group’s broader toolkit surfaced, and three of those families were examined as analyzable artifacts: GoldFinder, SIBOT, and GoldMax / SUNSHUTTLE. They are a different generation from SUNBURST, Go and VBScript rather than a .NET class smuggled into Orion, and Microsoft tied them to NOBELIUM on 4 March 2021. Studying them is useful for two reasons: they show the actor’s engineering habits off the supply-chain stage, and the GoldMax pair in particular delivers the book’s clearest lesson about why string-based IOCs age and code/behaviour endure.

Response, Consequences, and Policy Legacy

Mon, 01 Jan 0001 00:00:00 +0000

A different kind of chapter. The preceding account was anchored in reverse engineering, with public reporting clearly marked where the artifacts could not speak. This chapter is reporting: the emergency response, the sanctions, the landmark securities case, and the policy shift the incident set off. None of it is derived from the malware artifacts; it is checked against the public records linked below. Where a claim is contested or an estimate, the text says so.

Epilogue: The Privilege Multiplier — Orion as LocalSystem

Mon, 01 Jan 0001 00:00:00 +0000

Ten chapters of sophistication: a build pipeline implant, a dormant gated backdoor, a DGA control plane, memory-only loaders, a bespoke Go RAT. One product decision materially increased the potential impact: SolarWinds documents its platform services as running under LocalSystem, and SUNBURST deliberately arms inside SolarWinds.BusinessLayerHost.exe.

This epilogue makes one argument carefully: a trusted management service running with a powerful token gave malicious code more useful capability than a least-privilege service would have. The sloppy version (“the backdoor stole everything”) is wrong; the defensible version is about exposure and potential reach, not demonstrated use at every installation.

Appendix: Timeline, IOCs, and Artifact Map

Mon, 01 Jan 0001 00:00:00 +0000

Reference back matter for the book, consolidated from the technical analysis and public reporting cited throughout the chapters. External network indicators are defanged; file hashes are verbatim. Provenance flags from the chapters apply: compile timestamps are locally verified; day-level 2019 dates are secondary reporting; the valid Authenticode signature is vendor-documented, not verified here.

A. Master timeline

Date	Event	Evidence / note
~4 Sep 2019	Actor’s first unauthorized access to SolarWinds	SolarWinds investigation (reported date; not locally derived)
~12 Sep 2019	Trial (“skeleton”) code injected into Orion builds	SolarWinds investigation (reported date)
10 Oct 2019	Build `8890` ships with the benign empty stub	compile `2019-10-10 13:26:39` (verified); DLL `a25cadd4…`
~4 Nov 2019	Trial code removed	secondary
20 Feb 2020	SUNSPOT sample likely built	PE TimeDateStamp `2020-02-20 11:40:02 UTC` (read locally); CrowdStrike describes it as a likely build date; the timestamp does not establish deployment; `c45c9bda…`
24 Mar 2020	First weaponized SUNBURST build `9083` → shipped as Hotfix 5 (MSP)	compile `2020-03-24 08:52:34` (verified); `32519b85…`
24 Mar 2020	(parallel) SUPERNOVA sample PE timestamp (different actor)	timestamp `09:16:10` (verified); the sample does not establish its placement vector; public reporting associates deployments with Orion exploitation including CVE-2020-10148; `c15abaf5…`
~26 Mar 2020	Trojanized DLL reaches customers	secondary
21 Apr 2020	SUNBURST build `12394` (2020.2 RTM) compiled	`019085a7…`
11 May 2020	SUNBURST build `12432` (2020.2 HF1) compiled	`ce77d116…`
Apr–Jun 2020	Trojanized updates distributed; SolarWinds estimated fewer than 18,000 customers may have installed affected software	public company estimate; observed CDN URLs are download evidence, not an installation count
mid-2020	Selected victims escalated; TEARDROP/RAINDROP drop Cobalt Strike BEACON	`1817a5bf…`, `be9dbbec…`
~4 Jun 2020	Actor removes the injector from the build environment	secondary
8 Dec 2020	FireEye discloses its own breach (MFA enrollment alert)	public reporting
12 Dec 2020	FireEye notifies SolarWinds	Not stated
13 Dec 2020	Public disclosure; FireEye SUNBURST report + YARA; CISA ED 21-01	CISA ED 21-01
14 Dec 2020	SolarWinds files SEC Form 8-K	Not stated
15 Dec 2020	Killswitch: `avsvmcloud[.]com` seized, repointed to `20.140.0.1` (a stand-down range)	`20.140.0.1 ∈ 20.140.0.0/15` (verified)
5 Jan 2021	US joint statement: “likely Russian in origin”	FBI/CISA/ODNI/NSA joint statement
11 Jan 2021	CrowdStrike publishes SUNSPOT analysis (cluster StellarParticle)	CrowdStrike analysis
4 Mar 2021	Microsoft details GoldMax / GoldFinder / SIBOT (NOBELIUM)	Microsoft analysis; `f2a8bdf1…`, `7e05ff08…`, `94c58c7f…`
15 Apr 2021	US formally attributes to Russia’s SVR (APT29); sanctions; 10 diplomats expelled	U.S. Treasury announcement
2022	Mandiant merges UNC2452 into APT29	Mandiant assessment
Oct 2023 → Nov 2025	SEC v. SolarWinds & Brown: charged → most claims dismissed (Jul 2024) → dismissed with prejudice, no penalty (20 Nov 2025)	Chapter 10

B. SUNBURST DLL hashes (locally verified)

Build	SHA-256	MD5	Verdict
`2019.4.5200.8890`	`a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc`	`e18a6a21eb44e77ca8d739a72209c370`	benign (trial stub)
`2019.4.5200.9083`	`32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77`	`b91ce2fa41029f6955bff20079468448`	SUNBURST
`2020.2.5200.12394`	`019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134`	`2c4a910a1299cdae2a4e55988a2f102e`	SUNBURST
`2020.2.5300.12432`	`ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6`	`846e27a652a5e1bfbd0ddd38a16dc865`	SUNBURST

C. SUNBURST network / C2 indicators

All stored base64+DEFLATE-obfuscated in the DLL; decoded in Chapter 4.