In a highly sophisticated and targeted cyber espionage campaign, SolarWinds, a leading provider of IT management software, became the victim of a massive cyberattack disclosed in December 2020. This attack was orchestrated by allegedly state-sponsored hackers who managed to compromise the company's Orion software by inserting a malicious code into its updates. This backdoor, known as Sunburst, allowed the attackers unprecedented access to the networks of thousands of SolarWinds' clients, including top government agencies in the United States and numerous Fortune 500 companies. The breach's scale and the sensitivity of the data potentially accessed put at risk not only the financial assets and reputation of SolarWinds and its clients but also posed a significant threat to national security. The attackers demonstrated deep technical sophistication, enabling them to stay undetected for several months while conducting espionage and potentially extracting sensitive information.
Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a
TPRM report: https://scoringcyber.rankiteo.com/company/solarwinds
"id": "sol501050624",
"linkid": "solarwinds",
"type": "Cyber Attack",
"date": "12/2020",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'customers_affected': ['Top Government Agencies',
'Fortune 500 Companies'],
'industry': 'IT Management Software',
'name': 'SolarWinds',
'type': 'Corporation'}],
'attack_vector': 'Supply Chain Attack',
'data_breach': {'data_exfiltration': 'Potentially',
'sensitivity_of_data': 'High'},
'date_publicly_disclosed': 'December 2020',
'description': 'In a highly sophisticated and targeted cyber espionage '
'campaign, SolarWinds, a leading provider of IT management '
'software, became the victim of a massive cyberattack '
'disclosed in December 2020. This attack was orchestrated by '
'allegedly state-sponsored hackers who managed to compromise '
"the company's Orion software by inserting a malicious code "
'into its updates. This backdoor, known as Sunburst, allowed '
'the attackers unprecedented access to the networks of '
"thousands of SolarWinds' clients, including top government "
'agencies in the United States and numerous Fortune 500 '
"companies. The breach's scale and the sensitivity of the data "
'potentially accessed put at risk not only the financial '
'assets and reputation of SolarWinds and its clients but also '
'posed a significant threat to national security. The '
'attackers demonstrated deep technical sophistication, '
'enabling them to stay undetected for several months while '
'conducting espionage and potentially extracting sensitive '
'information.',
'impact': {'brand_reputation_impact': 'Significant',
'data_compromised': 'Sensitive Information',
'systems_affected': ['Orion Software', 'Networks of Clients']},
'initial_access_broker': {'backdoors_established': 'Sunburst',
'entry_point': 'Compromised Software Update',
'high_value_targets': ['Top Government Agencies',
'Fortune 500 Companies']},
'motivation': 'Espionage',
'threat_actor': 'Allegedly State-Sponsored Hackers',
'title': 'SolarWinds Cyber Espionage Campaign',
'type': 'Cyber Espionage',
'vulnerability_exploited': 'Compromised Software Update (Orion Software)'}