SolarWinds Compromise

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.(Citation: CrowdStrike StellarParticle January 2022) Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.(Citation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Volexity SolarWinds)(Citation: CrowdStrike StellarParticle January 2022)(Citation: Unit 42 SolarStorm December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: Microsoft Internal Solorigate Investigation Blog) In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Citation: Mandiant UNC2452 APT29 April 2022) The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.(Citation: USG Joint Statement SolarWinds January 2021)

This is a historical record and does not establish current campaign activity.

Threat actor

APT29

Attribution confidence

Not established

First documented activity

2019-08-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-08-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2021-01-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1606.002 · SAML Tokens

  Credential Access — During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Secureworks IRON RITUAL Profile)

• T1078.004 · Cloud Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.(Citation: CrowdStrike StellarParticle January 2022)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.(Citation: Volexity SolarWinds)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)

• T1087.002 · Domain Account

  Discovery — During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.(Citation: CrowdStrike StellarParticle January 2022)(Citation: Secureworks IRON RITUAL Profile)

• T1090.001 · Internal Proxy

  Command And Control — During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.(Citation: CrowdStrike StellarParticle January 2022)(Citation: Symantec RAINDROP January 2021)

• T1114.002 · Remote Email Collection

  Collection — During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)

• T1069.002 · Domain Groups

  Discovery — During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.(Citation: CrowdStrike StellarParticle January 2022)

• T1057 · Process Discovery

  Discovery — During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)

• T1584.001 · Domains

  Resource Development — For the SolarWinds Compromise, APT29 compromised domains to use for C2.(Citation: MSTIC NOBELIUM Mar 2021)

• T1016.001 · Internet Connection Discovery

  Discovery — During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.(Citation: MSTIC NOBELIUM Mar 2021)

• T1550 · Use Alternate Authentication Material

  Lateral Movement — During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.(Citation: Microsoft 365 Defender Solorigate)(Citation: Secureworks IRON RITUAL Profile)

• T1555.003 · Credentials from Web Browsers

  Credential Access — During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.(Citation: CrowdStrike StellarParticle January 2022)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.(Citation: CrowdStrike StellarParticle January 2022)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

• T1665 · Hide Infrastructure

  Command And Control — During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.(Citation: FireEye SUNBURST Backdoor December 2020)

• T1098.002 · Additional Email Delegate Permissions

  Persistence, Privilege Escalation — During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.(Citation: Volexity SolarWinds)(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: MSTIC Nobelium Oct 2021)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.(Citation: CrowdStrike StellarParticle January 2022)

• T1213 · Data from Information Repositories

  Collection — During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.(Citation: CrowdStrike StellarParticle January 2022)

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.(Citation: CrowdStrike StellarParticle January 2022)

• T1059.005 · Visual Basic

  Execution — For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.(Citation: Cybersecurity Advisory SVR TTP May 2021)

• T1568 · Dynamic Resolution

  Command And Control — During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.(Citation: Volexity SolarWinds)

• T1589.001 · Credentials

  Reconnaissance — For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.(Citation: CrowdStrike StellarParticle January 2022)

• T1552.004 · Private Keys

  Credential Access — During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.(Citation: Microsoft 365 Defender Solorigate)(Citation: Cybersecurity Advisory SVR TTP May 2021)

• T1587.001 · Malware

  Resource Development — For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.(Citation: Symantec RAINDROP January 2021)

• T1005 · Data from Local System

  Collection — During the SolarWinds Compromise, APT29 extracted files from compromised networks.(Citation: Volexity SolarWinds)

• T1685.001 · Disable or Modify Windows Event Log

  Defense Impairment — During the SolarWinds Compromise, APT29, used `AUDITPOL` to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1083 · File and Directory Discovery

  Discovery — During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.(Citation: Volexity SolarWinds)

• T1069 · Permission Groups Discovery

  Discovery — During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.(Citation: Volexity SolarWinds)

• T1018 · Remote System Discovery

  Discovery — During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1021.006 · Windows Remote Management

  Lateral Movement — During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.(Citation: Symantec RAINDROP January 2021)

• T1550.001 · Application Access Token

  Lateral Movement — During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.(Citation: CrowdStrike StellarParticle January 2022)

• T1098.003 · Additional Cloud Roles

  Persistence, Privilege Escalation — During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.(Citation: CrowdStrike StellarParticle January 2022)

• T1553.002 · Code Signing

  Defense Impairment — During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.(Citation: FireEye SUNBURST Backdoor December 2020)

• T1218.011 · Rundll32

  Stealth — During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1546.003 · Windows Management Instrumentation Event Subscription

  Privilege Escalation, Persistence — During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: Microsoft 365 Defender Solorigate)

• T1190 · Exploit Public-Facing Application

  Initial Access — During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)

• T1213.003 · Code Repositories

  Collection — During the SolarWinds Compromise, APT29 downloaded source code from code repositories.(Citation: Microsoft Internal Solorigate Investigation Blog)

• T1686 · Disable or Modify System Firewall

  Defense Impairment — During the SolarWinds Compromise, APT29 used `netsh` to configure firewall rules that limited certain UDP outbound packets.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1059.001 · PowerShell

  Execution — During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: CrowdStrike StellarParticle January 2022)

• T1070.004 · File Deletion

  Stealth — During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.(Citation: FireEye SUNBURST Backdoor December 2020)

• T1539 · Steal Web Session Cookie

  Credential Access — During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.(Citation: CrowdStrike StellarParticle January 2022)

• T1606.001 · Web Cookies

  Credential Access — During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.(Citation: Volexity SolarWinds)

• T1550.004 · Web Session Cookie

  Lateral Movement — During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.(Citation: Volexity SolarWinds)(Citation: CrowdStrike StellarParticle January 2022)

• T1074.002 · Remote Data Staging

  Collection — During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.(Citation: Volexity SolarWinds)

• T1098.005 · Device Registration

  Persistence, Privilege Escalation — During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.(Citation: Volexity SolarWinds)

• T1133 · External Remote Services

  Persistence, Initial Access — For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike StellarParticle January 2022)

• T1199 · Trusted Relationship

  Initial Access — During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: CrowdStrike StellarParticle January 2022)

• T1059.003 · Windows Command Shell

  Execution — During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

• T1070.006 · Timestomp

  Stealth — During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1558.003 · Kerberoasting

  Credential Access — During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1680 · Local Storage Discovery

  Discovery — During the SolarWinds Compromise, APT29 used `fsutil` to check available free space before executing actions that might create large files on disk.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1685 · Disable or Modify Tools

  Defense Impairment — During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1105 · Ingress Tool Transfer

  Command And Control — During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.(Citation: FireEye SUNBURST Backdoor December 2020)

• T1078.003 · Local Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.(Citation: CrowdStrike StellarParticle January 2022)

• T1070 · Indicator Removal

  Stealth — During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.(Citation: FireEye SUNBURST Backdoor December 2020)

• T1003.006 · DCSync

  Credential Access — During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)

• T1036.004 · Masquerade Task or Service

  Stealth — During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)

• T1098.001 · Additional Cloud Credentials

  Persistence, Privilege Escalation — During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: CrowdStrike StellarParticle January 2022)

• T1482 · Domain Trust Discovery

  Discovery — During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.(Citation: Volexity SolarWinds) They also used AdFind to enumerate domains and to discover trust between federated domains.(Citation: CrowdStrike StellarParticle January 2022)(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1555 · Credentials from Password Stores

  Credential Access — During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1047 · Windows Management Instrumentation

  Execution — During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1195.002 · Compromise Software Supply Chain

  Initial Access — During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)

• T1070.008 · Clear Mailbox Data

  Stealth — During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.(Citation: Volexity SolarWinds)

• T1484.002 · Trust Modification

  Defense Impairment, Privilege Escalation — During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.(Citation: Secureworks IRON RITUAL Profile)(Citation: Microsoft 365 Defender Solorigate)

• T1583.001 · Domains

  Resource Development — For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)

• T1087 · Account Discovery

  Discovery — During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.(Citation: Volexity SolarWinds)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: Cybersecurity Advisory SVR TTP May 2021)

• T1560.001 · Archive via Utility

  Collection — During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)

• T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

  Exfiltration — During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.(Citation: Volexity SolarWinds)

• T1071.001 · Web Protocols

  Command And Control — During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.(Citation: Volexity SolarWinds)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0024

  Official MITRE ATT&CK campaign record C0024. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.