Technical Deep Dive Into Solar Winds Breach | Qualys
Summary: Attackers compromised SolarWinds' software development and delivery pipeline and inserted malicious code into the SolarWinds.Orion.BusinessLayer.dll driver, which was then digitally signed and downloaded by thousands of users. The malware runs as an HTTP backdoor that resolves a generated FQDN under avsvmcloud.com via a domain generation algorithm and accepts encoded commands to collect system information, modify registries, and drop and execute second-stage files.
What's compelling: The infected DLL carried a valid digital signature, which is why it stayed undetected for a long time - the trust signal most organizations rely on was the exact thing that let the adversary operate.
Read the original at Qualys Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026