Malicious Domain in Solar Winds Hack Turned into ‘Killswitch’
Summary: Security experts commandeered avsvmcloud[.]com, a malicious domain used to control systems compromised in the SolarWinds breach, and reconfigured it as a killswitch that causes the SUNBURST malware to terminate itself under certain conditions. FireEye said it collaborated with GoDaddy and Microsoft to deactivate SUNBURST infections, which may have reached nearly 18,000 Orion customers after the software update servers were compromised in March 2020.
What you should know: FireEye noted the actor moved quickly to establish other persistent access beyond SUNBURST, so the killswitch will not remove the attacker from networks where additional backdoors exist - and SolarWinds' stock has fallen more than 20 percent as the SEC weighs an insider trading inquiry into pre-disclosure share sales.
Read the original at Krebs on Security ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026