Did Someone at the Commerce Dept. Find a Solar Winds Backdoor in Aug. 2020?
Summary: On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal that Microsoft and FireEye later identified as a fourth SolarWinds backdoor, called Sunshuttle by FireEye and GoldMax by Microsoft. Analysis of other submissions by the same VirusTotal account suggests it belongs to IT personnel at the National Telecommunications and Information Administration, a Commerce Department division that the Wall Street Journal reported had about three dozen email accounts breached by the SolarWinds attackers.
Bottom line: The file was flagged to a public scanning service in August 2020, but the SolarWinds compromise was not disclosed until December 2020, when FireEye published details of its own breach. The attackers, attributed by U.S. intelligence to Russia's SVR, had access through backdoored SolarWinds Orion updates shipped to some 18,000 users.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026