The SolarWinds Orion SUNBURST Backdoor

What happened

Attackers inserted code into the Orion build process. The result was a digitally signed DLL that SolarWinds distributed in a normal update package. Microsoft reports that the code sat in the RefreshInternal method and that the backdoor has almost 4,000 lines. It also says the attackers tested the insertion as early as October 2019 with empty classes.

Mandiant describes the behavior:

• The backdoor runs only inside solarwinds.businesslayerhost processes.
• It stays dormant for a random period of 12 to 14 days.
• It checks for security and forensic tools and does not run when it finds them.
• It builds a unique subdomain of avsvmcloud.com for each victim. The DNS answer then points to the real command server.
• Its traffic imitates the Orion Improvement Program.

The backdoor supports commands such as running a process, listing and writing files, reading and writing registry values, and rebooting. Mandiant says the attackers later used a memory-only dropper named TEARDROP and Cobalt Strike BEACON on selected victims. Mandiant tracks the actor as UNC2452.

Affected versions

Orion Platform builds from 2019.4 HF5 through 2020.2.1, before the fix, are affected. Mandiant names the trojanized package CORE-2019.4.5220.20574-SolarWinds-Core-v2019.4.5220-Hotfix5.msp.

• 2019.4 HF4: clean baseline before the bad update
• 2019.4 HF5 (build 2019.4.5220.20574): first trojanized build, signed 24 March 2020
• 2020.2.1 HF1: the release that Mandiant recommends upgrading to, after you preserve forensic data

Indicators of compromise

• SolarWinds.Orion.Core.BusinessLayer.dll MD5: b91ce2fa41029f6955bff20079468448
• Update package MD5: 02af7cec58b9a5da1c542b5a32151ba1
• Command domain: avsvmcloud.com and its subdomains, including regional appsync-api names
• Signing certificate serial number: 0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed
• A file gracious_truth.jpg read by the TEARDROP dropper
• Mandiant publishes YARA rules in its sunburst_countermeasures repository on GitHub

How to check

Hash the DLL on every Orion server and compare it with the MD5 above.

Get-ChildItem -Path "C:\Program Files (x86)\SolarWinds" -Recurse -Filter SolarWinds.Orion.Core.BusinessLayer.dll | Get-FileHash -Algorithm MD5

Then search DNS logs for the command domain.

Select-String -Path .\dns.log -Pattern "avsvmcloud"

Check the Orion version in the web console under Settings, then Details, then Orion Core.

What to do now

1. Isolate Orion servers and block their internet egress.
2. Preserve forensic images and logs, then upgrade to Orion 2020.2.1 HF1 or later.
3. Restrict the servers' connection to Tier 0 assets and limit local admin scope.
4. Change the passwords of accounts that have access to the Orion servers.
5. Review network device configurations for unauthorized changes.
6. Run the Mandiant YARA rules on affected hosts.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. Here one existing DLL gained network, download and execution behavior. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 64

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    SolarWinds.Orion.Core.BusinessLayer.dll
           It now downloads from the internet. It did not before.

Sources

1. cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
2. microsoft.com/en-us/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/