Solar Storm Supply Chain Attack Timeline
Summary: Unit 42 reported that the SolarStorm supply chain attack on SolarWinds Orion, disclosed Dec. 13, 2020, involved command and control infrastructure set up as early as August 2019, with the first modified software released in October 2019 and weaponized SUNBURST updates distributed around March 2020. Palo Alto Networks' own SOC observed its Orion server request the avsvmcloud[.]com domain on Sept. 29, 2020, and a second connection on Oct. 5, 2020 that downloaded a payload Cortex XDR detected and prevented before execution.
What's compelling: The attackers spent more than a year building infrastructure and SSL certificates before the first weaponized update shipped, and Microsoft reported working with more than 40 targeted companies - a reminder that the dwell time precedes the disclosure by many months.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026