Highly Elusive Attackers Leverage SolarWinds Supply Chain to Compromise Victims With SUNBURST Backdoor

For technical teams

1. Agencies that have the capabilities to handle the situation to take the following actions immediately: Official source
2. To create copies of system memory and/or host operating systems hosting all instances of SolarWinds Orion versions 2019.4 through 2020.2.1 HF1; Analyse for new user or service accounts, privileged or otherwise; Analyse stored network traffic for indicators of compromise (IoC), including new external DNS domains that have had connections to IoC. Indicators of compromise are listed above; Restrict the scope of connectivity to critical endpoints from SolarWind servers; Restrict the scope of accounts that have local administrator privileged on SolarWind servers; and Apply the new hotfix issued by SolarWinds version 2020.2.1 HF2. Official source
3. Affected agencies that have limited capabilities to handle the situation shall immediately disconnect or power down SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1, from their network. Official source
4. NC4 recommends that affected agencies rebuild the Windows operating system and reinstall the SolarWinds software package from trusted sources; and Agencies are prohibited from re-joining the Windows host OS to the enterprise domain until proper clean-up has been done and the new hotfix issued out by SolarWinds is applied – version 2020.2.1 HF2. Official source
5. Block all traffic to and from hosts, external to the enterprise, where any version of SolarWinds Orion software has been installed; Official source
6. Identify and remove all threat actor-controlled accounts and identified persistence mechanisms; and Official source
7. After all threat actor-controlled accounts have been deleted, reset all credentials used by or stored in SolarWinds software. Official source