Solar Winds: What Hit Us Could Hit Others
Summary: Researchers found the SolarWinds attackers first compromised the company's development environment on Sept. 4, 2019, then used Sunspot malware to test whether a Sunburst backdoor could be inserted into Orion without tripping alarms or alerting developers. By February 2020 Sunspot had injected Sunburst into the Orion source code, which SolarWinds digitally signed and shipped to customers, while a third strain, Teardrop, was later found on networks at Commerce, Energy, Treasury, Justice and the Administrative Office of the U.S. Courts.
Why it matters: SolarWinds CEO Sudhakar Ramakrishna said the same development process is likely common across the software industry, so the technique that put a backdoor in Orion could be repurposed against other major software providers - and the signed update carried it to thousands of customers.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026