Responding to the Solar Winds Breach: Detect, Prevent, and Remediate the Dark Halo Supply Chain Attack
Summary: Volexity published a guide on December 16, 2020, to help organizations determine whether they were compromised in the SolarWinds breach tied to the group it calls Dark Halo, following its earlier post on multiple incident response efforts. The guide says organizations that regularly updated SolarWinds Orion should assume they ran a compromised version, and that a CNAME response from a DNS query to avsvmcloud[.]com is the best way to determine if an organization was of interest to Dark Halo.
Key Takeaway: Running the compromised software does not by itself mean data loss or a hands-on intrusion, and Volexity surmises most organizations running it were never further targeted - but the published IOC list should not be considered exhaustive, since Dark Halo may have used certain domains against only one victim.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026