Threat Advisory: Solar Winds supply chain attack
Summary: A likely state-sponsored actor compromised trojanized updates to SolarWinds Orion software, specifically the SolarWinds.Orion.Core.BusinessLayer.dll component in versions 2019.4 HF 5 through 2020.2.1, with the backdoor tracked by FireEye as SUNBURST. SolarWinds confirmed fewer than 18,000 of its 300,000 customers downloaded the compromised update, and initial findings suggest the campaign began in late February 2020 and lasted several months.
What's compelling: The adversary used administrative privileges from the on-premise compromise to forge SAML tokens with its own trusted certificate, impersonating highly privileged accounts and bypassing multi-factor authentication for services such as Office365 - and the targeted users were often key IT and security personnel.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026