SolarWinds

The SolarWinds cyberattack, attributed to Russian Foreign Intelligence Service (SVR) APT group, represents one of the most significant and sophisticated cybersecurity breaches. This campaign exploited the SolarWinds Orion software, through which the attackers inserted malicious code into the software's updates sent to thousands of customers. The breach enabled extensive surveillance and data exfiltration capabilities, impacting numerous high-profile organizations globally, including US government agencies and major corporations. The attackers gained access to sensitive information, including national security data, intellectual property, and enterprise secrets. The severity of the attack lies in its scope, the level of access obtained, and the duration of unnoticed activities, highlighting critical vulnerabilities in the supply chain security and the challenges in defending against state-sponsored cyber operations.

Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a

TPRM report: https://scoringcyber.rankiteo.com/company/solarwinds

"id": "sol708050624",
"linkid": "solarwinds",
"type": "Vulnerability",
"date": "04/2022",
"severity": "100",
"impact": "8",
"explanation": "Attack that could bring to a war"

{'affected_entities': [{'customers_affected': 'Thousands of customers',
                        'industry': 'Technology',
                        'location': 'United States',
                        'name': 'SolarWinds',
                        'type': 'Corporation'},
                       {'industry': 'Public Sector',
                        'location': 'United States',
                        'name': 'US Government Agencies',
                        'type': 'Government'},
                       {'industry': 'Various',
                        'location': 'Global',
                        'name': 'Major Corporations',
                        'type': 'Corporation'}],
 'attack_vector': 'Malicious Software Update',
 'data_breach': {'data_exfiltration': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['National Security Data',
                                              'Intellectual Property',
                                              'Enterprise Secrets']},
 'description': 'The SolarWinds cyberattack, attributed to Russian Foreign '
                'Intelligence Service (SVR) APT group, represents one of the '
                'most significant and sophisticated cybersecurity breaches. '
                'This campaign exploited the SolarWinds Orion software, '
                'through which the attackers inserted malicious code into the '
                "software's updates sent to thousands of customers. The breach "
                'enabled extensive surveillance and data exfiltration '
                'capabilities, impacting numerous high-profile organizations '
                'globally, including US government agencies and major '
                'corporations. The attackers gained access to sensitive '
                'information, including national security data, intellectual '
                'property, and enterprise secrets. The severity of the attack '
                'lies in its scope, the level of access obtained, and the '
                'duration of unnoticed activities, highlighting critical '
                'vulnerabilities in the supply chain security and the '
                'challenges in defending against state-sponsored cyber '
                'operations.',
 'impact': {'data_compromised': ['National Security Data',
                                 'Intellectual Property',
                                 'Enterprise Secrets'],
            'systems_affected': 'SolarWinds Orion Software'},
 'initial_access_broker': {'entry_point': 'SolarWinds Orion Software',
                           'high_value_targets': ['US Government Agencies',
                                                  'Major Corporations']},
 'lessons_learned': 'Critical vulnerabilities in the supply chain security and '
                    'the challenges in defending against state-sponsored cyber '
                    'operations.',
 'motivation': ['Espionage', 'Data Exfiltration'],
 'post_incident_analysis': {'root_causes': 'Vulnerabilities in supply chain '
                                           'security'},
 'threat_actor': 'Russian Foreign Intelligence Service (SVR) APT group',
 'title': 'SolarWinds Cyberattack',
 'type': 'Supply Chain Attack',
 'vulnerability_exploited': 'SolarWinds Orion Software'}