Threat Source newsletter (Dec. 17, 2020)
Summary: State-sponsored actors compromised digitally signed updates to SolarWinds Orion IT monitoring software posted on the SolarWinds website from March to May 2020, with the backdoor loaded by the legitimate executable before its own code runs. At least two U.S. government agencies, Treasury and Commerce, were affected, and DHS and CISA issued an emergency alert directing federal civilian agencies to review networks for indicators of compromise and disconnect SolarWinds Orion products immediately.
Why it matters: The malicious updates carried valid digital signatures for roughly three months, so the trust anchor most organizations rely on to approve software gave no warning - and the same incident reached two U.S. Treasury and Commerce department networks.
Read the original at Cisco Talos ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026