Dark Halo Leverages Solar Winds Compromise to Breach Organizations
Summary: Volexity tied the SolarWinds Orion backdoor campaign that FireEye attributed to UNC2452 to three separate incidents it investigated at a US-based think tank in late 2019 and 2020, tracking the actor as Dark Halo. In the second incident the actor read the Duo integration secret key (akey) from an OWA server and used it to forge a valid duo-sid cookie, bypassing MFA; in the third, in June and July 2020, the actor entered via SolarWinds Orion, exported targeted mailboxes with New-MailboxExportRequest, and exfiltrated the data through the OWA server.
What's compelling: The actor's primary goal was the email of a handful of select executives, policy experts, and IT staff, and it stayed undetected for several years in the first incident - so the question is whether your MFA integration secrets and Exchange logs would show you an attacker who never triggers a second-factor prompt.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026