Threat Brief: Solar Storm and SUNBURST Customer Coverage
Summary: FireEye disclosed a breach and data exfiltration by an actor it calls UNC2452, which Unit 42 tracks as SolarStorm, carried out through a trojanized update file for the SolarWinds Orion Platform. Unit 42 identified related TEARDROP malware, a memory-only dropper with SHA256 118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51 that deploys a customized Cobalt Strike BEACON and contains a beacon request to the previously unreported domain mobilnweb[.]com.
Bottom line: Any organization running SolarWinds Orion is potentially at risk, and the trojanized installer SolarWinds-Core-v2019.4.5220-Hotfix5.msp was still reachable at the time of publication - so the question is whether Orion systems in your network are already compromised with SUNBURST.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026