Skip to content

C0024 SolarWinds Compromise

The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. Industry reporting initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.10114121387

In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia’s Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.9125 The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.3

Item Value
ID C0024
Associated Names
First Seen August 2019
Last Seen January 2021
Version 1.0
Created 24 March 2023
Last Modified 14 April 2023
Navigation Layer View In ATT&CK® Navigator

Groups

ID Name References
G0016 APT29 9125

Techniques Used

Domain ID Name Use
enterprise T1087 Account Discovery During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.1
enterprise T1087.002 Domain Account During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing Get-ADUser and Get-ADGroupMember.222
enterprise T1098 Account Manipulation -
enterprise T1098.001 Additional Cloud Credentials During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.142
enterprise T1098.002 Additional Email Delegate Permissions During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.11423
enterprise T1098.003 Additional Cloud Roles During the SolarWinds Compromise, APT29 granted company administrator privileges to a newly created service principle.2
enterprise T1098.005 Device Registration During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the Set-CASMailbox command.1
enterprise T1583 Acquire Infrastructure -
enterprise T1583.001 Domains For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.1516
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.1
enterprise T1560 Archive Collected Data -
enterprise T1560.001 Archive via Utility During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.1182
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.182
enterprise T1059.003 Windows Command Shell During the SolarWinds Compromise, APT29 used cmd.exe to execute commands on remote machines.18
enterprise T1059.005 Visual Basic For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.21
enterprise T1584 Compromise Infrastructure -
enterprise T1584.001 Domains For the SolarWinds Compromise, APT29 compromised domains to use for C2.15
enterprise T1555 Credentials from Password Stores During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.18
enterprise T1555.003 Credentials from Web Browsers During the SolarWinds Compromise, APT29 stole users’ saved passwords from Chrome.2
enterprise T1213 Data from Information Repositories During the SolarWinds Compromise, APT29 accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.2
enterprise T1213.003 Code Repositories During the SolarWinds Compromise, APT29 downloaded source code from code repositories.7
enterprise T1005 Data from Local System During the SolarWinds Compromise, APT29 extracted files from compromised networks.1
enterprise T1074 Data Staged -
enterprise T1074.002 Remote Data Staging During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim’s OWA server.1
enterprise T1140 Deobfuscate/Decode Files or Information During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.20
enterprise T1587 Develop Capabilities -
enterprise T1587.001 Malware For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.41918
enterprise T1484 Domain Policy Modification -
enterprise T1484.002 Domain Trust Modification During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.2217
enterprise T1482 Domain Trust Discovery During the SolarWinds Compromise, APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.1 They also used AdFind to enumerate domains and to discover trust between federated domains.218
enterprise T1568 Dynamic Resolution During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.1
enterprise T1114 Email Collection -
enterprise T1114.002 Remote Email Collection During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.121
enterprise T1546 Event Triggered Execution -
enterprise T1546.003 Windows Management Instrumentation Event Subscription During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with rundll32.exe.1817
enterprise T1048 Exfiltration Over Alternative Protocol -
enterprise T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim’s OWA servers.1
enterprise T1190 Exploit Public-Facing Application During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.121
enterprise T1133 External Remote Services For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.152
enterprise T1083 File and Directory Discovery During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.1
enterprise T1606 Forge Web Credentials -
enterprise T1606.001 Web Cookies During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.1
enterprise T1606.002 SAML Tokens During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.1422
enterprise T1589 Gather Victim Identity Information -
enterprise T1589.001 Credentials For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.2
enterprise T1562 Impair Defenses -
enterprise T1562.001 Disable or Modify Tools During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.18
enterprise T1562.002 Disable Windows Event Logging During the SolarWinds Compromise, APT29, used AUDITPOL to prevent the collection of audit logs.18
enterprise T1562.004 Disable or Modify System Firewall During the SolarWinds Compromise, APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.18
enterprise T1070 Indicator Removal During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.4
enterprise T1070.004 File Deletion During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.4
enterprise T1070.006 Timestomp During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.18
enterprise T1070.008 Clear Mailbox Data During the SolarWinds Compromise, APT29 removed evidence of email export requests using Remove-MailboxExportRequest.1
enterprise T1105 Ingress Tool Transfer During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.4
enterprise T1036 Masquerading During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.4
enterprise T1036.004 Masquerade Task or Service During the SolarWinds Compromise, APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.1
enterprise T1036.005 Match Legitimate Name or Location During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.18
enterprise T1003 OS Credential Dumping -
enterprise T1003.006 DCSync During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.17182
enterprise T1069 Permission Groups Discovery During the SolarWinds Compromise, APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.1
enterprise T1069.002 Domain Groups During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.2
enterprise T1057 Process Discovery During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.1182
enterprise T1090 Proxy -
enterprise T1090.001 Internal Proxy During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.220
enterprise T1021 Remote Services -
enterprise T1021.001 Remote Desktop Protocol During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.2
enterprise T1021.002 SMB/Windows Admin Shares During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.2
enterprise T1021.006 Windows Remote Management During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.20
enterprise T1018 Remote System Discovery During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.18
enterprise T1053 Scheduled Task/Job -
enterprise T1053.005 Scheduled Task During the SolarWinds Compromise, APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.1419
enterprise T1558 Steal or Forge Kerberos Tickets -
enterprise T1558.003 Kerberoasting During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.18
enterprise T1539 Steal Web Session Cookie During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.2
enterprise T1553 Subvert Trust Controls -
enterprise T1553.002 Code Signing During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.4
enterprise T1195 Supply Chain Compromise -
enterprise T1195.002 Compromise Software Supply Chain During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.1142118
enterprise T1218 System Binary Proxy Execution -
enterprise T1218.011 Rundll32 During the SolarWinds Compromise, APT29 used Rundll32.exe to execute payloads.1418
enterprise T1082 System Information Discovery During the SolarWinds Compromise, APT29 used fsutil to check available free space before executing actions that might create large files on disk.18
enterprise T1016 System Network Configuration Discovery -
enterprise T1016.001 Internet Connection Discovery During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.15
enterprise T1199 Trusted Relationship During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.212
enterprise T1552 Unsecured Credentials -
enterprise T1552.004 Private Keys During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.1721
enterprise T1550 Use Alternate Authentication Material During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.1722
enterprise T1550.001 Application Access Token During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.2
enterprise T1550.004 Web Session Cookie During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged duo-sid cookie to bypass MFA set on an email account.12
enterprise T1078 Valid Accounts During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.41521
enterprise T1078.002 Domain Accounts During the SolarWinds Compromise, APT29 used domain administrators’ accounts to help facilitate lateral movement on compromised networks.2
enterprise T1078.003 Local Accounts During the SolarWinds Compromise, APT29 used compromised local accounts to access victims’ networks.2
enterprise T1078.004 Cloud Accounts During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.2
enterprise T1047 Windows Management Instrumentation During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.1718

Software

ID Name Description
S0552 AdFind 82

References

  1. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  2. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  3. FBI, CISA, ODNI, NSA. (2022, January 5). Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA). Retrieved March 26, 2023. ↩

  4. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩↩↩↩↩↩↩↩↩↩

  5. Mandiant. (2020, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023. ↩↩

  6. Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021. ↩

  7. MSRC Team. (2021, February 18). Microsoft Internal Solorigate Investigation – Final Update. Retrieved May 14, 2021. ↩↩

  8. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021. ↩↩↩↩↩

  9. NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021. ↩↩

  10. SolarWinds. (2020, December 24). SolarWinds Security Advisory. Retrieved February 22, 2021. ↩

  11. Sudhakar Ramakrishna . (2021, January 11). New Findings From Our Investigation of SUNBURST. Retrieved January 13, 2021. ↩↩

  12. UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021. ↩↩

  13. Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023. ↩

  14. MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 30, 2020. ↩↩↩↩

  15. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021. ↩↩↩↩↩

  16. Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021. ↩

  17. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021. ↩↩↩↩↩↩

  18. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  19. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. ↩↩

  20. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021. ↩↩↩

  21. NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021. ↩↩↩↩↩↩↩

  22. Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022. ↩↩↩↩

  23. Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022. ↩

  24. Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021. ↩

  25. Stephen Eckels, Jay Smith, William Ballenthin. (2020, December 24). SUNBURST Additional Technical Details. Retrieved January 6, 2021. ↩

  26. Symantec Threat Hunter Team. (2021, January 22). SolarWinds: How Sunburst Sends Data Back to the Attackers. Retrieved January 22, 2021. ↩