Alpha Team Flash Report: SolarWinds Hack

Alpha Team Flash Report: SolarWinds Breach

On 13 December 2020, Reuters reported that Solarwinds, a large IT and software firm, was compromised in what appears to be a highly sophisticated and targeted attack by a nation-state. According to Kevin Thompson, CEO of SolarWinds, the update mechanism for the company’s monitoring product Orion was vulnerable and tampered with from March to June of this year. While the investigation is still ongoing, FireEye has attributed the attack to a threat actor group under a neutral codename, UNC2452, reportedly the same group that breached FireEye this year. According to Reuters' sources, UNC2452 is APT29.

Recommendations

• If possible, ensure any SolarWinds servers are isolated until a forensic investigation has taken place. Block all internet egress from the hosts.
• Update Orion to the latest release 2020.2.1 HF1 Download and review the publicly accessible ClamAV, snort, Yara and HXIOC rules released by FireEye at https://github.com/fireeye/sunburst_countermeasures/tree/main/rules
• Perform continuous monitoring of news related to this breach for associated indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs)

Details

According to FireEye, UNC2452, a neutral codename given to the group by the company, is reportedly the same highly-evasive threat actor that breached FireEye, gained access to SolarWinds infrastructure, and added malicious code to a DLL used by Orion, a product used by enterprises for infrastructure monitoring. The backdoor added to the DLL files has been named “SUNBURST.” When a user downloads or updates Orion, the trojanized DLL is loaded, and the backdoor beacons out to a Command and Control (C2) server to retrieve additional payloads and get commands. This supply-chain attack is designed to exfiltrate data from the targeted company, and the actors employ multiple TTPs to mask their actions on the compromised network.

The listed C2 domain, avsvmcloud[.]com, is currently registered on GoDaddy and has been since December 2019.

Multiple trojanized updates were digitally signed and deployed from March - May 2020 and posted to the SolarWinds updates website, including:

hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20574/SolarWinds-Core-v2019.4.5220-Hotfix5.msp

The backdoor, SUNBURST, injects itself into legitimate background jobs and scheduled tasks which Orion employs. This remains inactive for up to two weeks in order to avoid detection. Once activated, the backdoor contacts the C2 infrastructure and executes commands that include functions to transfer files, execute files, profile the system, reboot the machine, and disable services. The backdoor uses multiple blocklists to prevent detection from forensic and anti-virus tools. Attackers also renamed C2 infrastructure to align with hostnames found within the compromised network in order to mask malicious activity to observers and blend in with legitimate HTTP traffic.

In a leaked Microsoft advisory about the same attack, researchers indicated that the attackers compromised signed libraries to circumvent trust chain controls. Microsoft subsequently removed the certificate from their trust chain.

Figure 1: Digital signature on the software containing the SUNBURST backdoor

Once the attackers have compromised a target network, they maintain access through captured credentials and compromised accounts for lateral movement, however, malware has been deployed using SUNBURST, including a dropper called TEARDROP which deploys Cobalt Strike.

Activity indicating compromise has been detected at multiple entities worldwide, across multiple verticals. Victims include government agencies, consulting, telcos, and technology firms. Targeted geolocations include North America, Europe, Asia, and the Middle East.

Countermeasures and detection rules have been developed and made available for threat hunters and analysts to monitor internal networks. These have been released via GitHub.

Indicators

Multiple Indicators of Compromise (IoC’s) have been made publicly available by FireEye, Microsoft and the security research community to allow businesses to detect and mitigate potential malicious activity.

ZeroFOX Threat Feed users can access the indicators via campaign ID 125

SHA256:
d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
53f8dfc65169ccda021b72a62e0c22a4db7c4077f002fa742717d41b3c40f2c7
019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
292327e5c94afa352cc5a02ca273df543f2020d0e76368ff96c84f4e90778712
c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71

SHA1:
76640508b1e7759e548771a5359eaed353bf1eec
1acf3108bf1e376c8848fbb25dc87424f2c2a39c
e257236206e99f5a5c62035c9c59c57206728b28
bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
5fdd82b7ca1c1f0ec67c05b36d14c9517065353b
2f1a5a7411d015d01aaee4535835400191645023
d130bd75645c2433f88ac03e73395fba172ef676
1b476f58ca366b54f34d714ffce3fd73cc30db1a
47d92d49e6f7f296260da1af355f941eb25360c4
C2c30b3a287d82f88753c85cfb11ec9eb1466bad
75af292f34789a1c782ea36c7127bf6106f595e8

md5:

02af7cec58b9a5da1c542b5a32151ba1
08e35543d6110ed11fdf558bb093d401
2c4a910a1299cdae2a4e55988a2f102e
846e27a652a5e1bfbd0ddd38a16dc865
b91ce2fa41029f6955bff20079468448
4f2eb62fa529c0283b28d05ddd311fae
56ceb6d0011d87b6e4d7023d7ef85676


C2 and Beacon Indicators:

6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud[.]com
freescanonline[.]com
7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud[.]com
deftsecurity[.]com
gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud[.]com
54.193.127.66
ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud[.]com
thedoccloud[.]com
k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud[.]com
mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud[.]com
13.59.205.66
54.215.192.52
websitetheme[.]com
34.203.203.23
highdatabase[.]com
139.99.115.204
incomeupdate[.]com
5.252.177.25
databasegalore[.]com
5.252.177.21
panhardware[.]com
204.188.205.176
zupertech[.]com
51.89.125.18
167.114.213.199