SUPERNOVA: A Novel .NET Webshell
Summary: Unit 42 analyzed SUPERNOVA, a trojanized SolarWinds Orion .NET library (app_web_logoimagehandler.ashx.b6031896.dll) that adds four GET parameters - codes, clazz, method and args - to the logo image handler and compiles the supplied .NET code in-memory with no artifact written to disk. The researchers note the webshell's link to the SolarStorm actors is now questionable because the .dll was not digitally signed, unlike SUNBURST, suggesting a third party may have dropped it.
What you should know: The implant runs inside Orion, whose user is typically highly privileged and has broad visibility across the network, and its in-memory execution evades most endpoint detections - so any request to logoimagehandler.ashx carrying those four parameters in any order is the indicator defenders are told to isolate and image on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026