SolarWinds Compromise

The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. Industry reporting initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.^[1]^[2]^[3]^[4]^[5]^[6]^[7]^[8]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.^[9]^[10]^[11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.^[12]

ID: C0024

First Seen: August 2019 ^[6]

Last Seen: January 2021 ^[13]

Version: 1.0

Created: 24 March 2023

Last Modified: 14 April 2023

Version Permalink

Live Version

Groups

ID	Name	Description
G0016	APT29	^[9]^[10]^[11]

Techniques Used

Domain	ID		Name	Use
Enterprise	T1087		Account Discovery	During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.^[4]
		.002	Domain Account	During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.^[5]^[14]
Enterprise	T1098	.001	Account Manipulation: Additional Cloud Credentials	During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.^[15]^[5]
		.002	Account Manipulation: Additional Email Delegate Permissions	During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.^[4]^[15]^[16]
		.003	Account Manipulation: Additional Cloud Roles	During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.^[5]
		.005	Account Manipulation: Device Registration	During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.^[4]
Enterprise	T1583	.001	Acquire Infrastructure: Domains	For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.^[17]^[18]
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.^[4]
Enterprise	T1560	.001	Archive Collected Data: Archive via Utility	During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.^[4]^[19]^[5]
Enterprise	T1059	.001	Command and Scripting Interpreter: PowerShell	During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.^[4]^[7]^[5]
		.003	Command and Scripting Interpreter: Windows Command Shell	During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.^[4]^[7]
		.005	Command and Scripting Interpreter: Visual Basic	For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.^[20]
Enterprise	T1584	.001	Compromise Infrastructure: Domains	For the SolarWinds Compromise, APT29 compromised domains to use for C2.^[17]
Enterprise	T1555		Credentials from Password Stores	During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.^[19]
		.003	Credentials from Web Browsers	During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.^[5]
Enterprise	T1213		Data from Information Repositories	During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.^[5]
		.003	Code Repositories	During the SolarWinds Compromise, APT29 downloaded source code from code repositories.^[8]
Enterprise	T1005		Data from Local System	During the SolarWinds Compromise, APT29 extracted files from compromised networks.^[4]
Enterprise	T1074	.002	Data Staged: Remote Data Staging	During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.^[4]
Enterprise	T1140		Deobfuscate/Decode Files or Information	During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.^[21]
Enterprise	T1587	.001	Develop Capabilities: Malware	For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.^[3]^[22]^[19]
Enterprise	T1484	.002	Domain or Tenant Policy Modification: Trust Modification	During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.^[14]^[23]
Enterprise	T1482		Domain Trust Discovery	During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.^[4] They also used AdFind to enumerate domains and to discover trust between federated domains.^[5]^[19]
Enterprise	T1568		Dynamic Resolution	During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.^[4]
Enterprise	T1114	.002	Email Collection: Remote Email Collection	During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.^[4]^[20]
Enterprise	T1546	.003	Event Triggered Execution: Windows Management Instrumentation Event Subscription	During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.^[19]^[23]
Enterprise	T1048	.002	Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.^[4]
Enterprise	T1190		Exploit Public-Facing Application	During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.^[4]^[20]
Enterprise	T1133		External Remote Services	For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.^[17]^[5]
Enterprise	T1083		File and Directory Discovery	During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.^[4]
Enterprise	T1606	.001	Forge Web Credentials: Web Cookies	During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.^[4]
		.002	Forge Web Credentials: SAML Tokens	During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.^[15]^[14]
Enterprise	T1589	.001	Gather Victim Identity Information: Credentials	For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.^[5]
Enterprise	T1665		Hide Infrastructure	During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.^[3]
Enterprise	T1562	.001	Impair Defenses: Disable or Modify Tools	During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.^[19]
		.002	Impair Defenses: Disable Windows Event Logging	During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.^[19]
		.004	Impair Defenses: Disable or Modify System Firewall	During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.^[19]
Enterprise	T1070		Indicator Removal	During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.^[3]
		.004	File Deletion	During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.^[3]
		.006	Timestomp	During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.^[19]
		.008	Clear Mailbox Data	During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.^[4]
Enterprise	T1105		Ingress Tool Transfer	During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.^[3]
Enterprise	T1036	.004	Masquerading: Masquerade Task or Service	During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.^[4]
		.005	Masquerading: Match Legitimate Name or Location	During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.^[4]^[7]
Enterprise	T1003	.006	OS Credential Dumping: DCSync	During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.^[23]^[19]^[5]
Enterprise	T1069		Permission Groups Discovery	During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.^[4]
		.002	Domain Groups	During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.^[5]
Enterprise	T1057		Process Discovery	During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.^[4]^[19]^[5]
Enterprise	T1090	.001	Proxy: Internal Proxy	During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.^[5]^[21]
Enterprise	T1021	.001	Remote Services: Remote Desktop Protocol	During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.^[5]
		.002	Remote Services: SMB/Windows Admin Shares	During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.^[5]
		.006	Remote Services: Windows Remote Management	During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.^[21]
Enterprise	T1018		Remote System Discovery	During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.^[19]
Enterprise	T1053	.005	Scheduled Task/Job: Scheduled Task	During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.^[4]^[3]^[22]
Enterprise	T1558	.003	Steal or Forge Kerberos Tickets: Kerberoasting	During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.^[19]
Enterprise	T1539		Steal Web Session Cookie	During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.^[5]
Enterprise	T1553	.002	Subvert Trust Controls: Code Signing	During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.^[3]
Enterprise	T1195	.002	Supply Chain Compromise: Compromise Software Supply Chain	During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.^[2]^[3]^[20]^[19]
Enterprise	T1218	.011	System Binary Proxy Execution: Rundll32	During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.^[15]^[19]
Enterprise	T1082		System Information Discovery	During the SolarWinds Compromise, APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.^[19]
Enterprise	T1016	.001	System Network Configuration Discovery: Internet Connection Discovery	During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.^[17]
Enterprise	T1199		Trusted Relationship	During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.^[20]^[5]
Enterprise	T1552	.004	Unsecured Credentials: Private Keys	During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.^[23]^[20]
Enterprise	T1550		Use Alternate Authentication Material	During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.^[23]^[14]
		.001	Application Access Token	During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.^[5]
		.004	Web Session Cookie	During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.^[4]^[5]
Enterprise	T1078		Valid Accounts	During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.^[3]^[17]^[20]
		.002	Domain Accounts	During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.^[5]
		.003	Local Accounts	During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.^[5]
		.004	Cloud Accounts	During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.^[5]
Enterprise	T1047		Windows Management Instrumentation	During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.^[23]^[19]

Software

ID	Name	Description
S0552	AdFind	^[7]^[5]
S0154	Cobalt Strike	^[3]^[20]
S0597	GoldFinder	^[17]
S0588	GoldMax	^[17]
S0002	Mimikatz	^[23]^[5]
S0565	Raindrop	^[19]^[21]
S0589	Sibot	^[17]
S0559	SUNBURST	^[3]^[19]^[24]^[2]^[25]^[26]
S0562	SUNSPOT	^[22]
S0560	TEARDROP	^[19]^[26]^[3]
S0682	TrailBlazer	^[5]

SolarWinds Compromise

Groups

Enterprise Layer

Techniques Used

Software

References