Quick answer: In 2020, attackers later attributed by the US government to Russia’s foreign intelligence service (SVR) inserted a backdoor into updates for SolarWinds Orion, a widely used IT monitoring product. Thousands of organizations, including US government agencies, installed the trojanized updates. The attack was discovered in December 2020 by the security company FireEye after its own tools were stolen.
| Key facts | |
|---|---|
| Date | Compromised updates released in 2020; discovered December 2020 |
| Organization | SolarWinds and its Orion customers |
| Type of attack | Software supply chain attack |
| Attacker | Attributed by the US government to Russia’s SVR |
| Impact | Backdoor installed by thousands of organizations; follow-on intrusions at US agencies and companies |
| Response | CISA Emergency Directive 21-01 ordered federal agencies to disconnect affected Orion systems |
Timeline
- 2019 to 2020: Attackers gain access to SolarWinds’ build environment and insert malicious code into Orion updates.
- 2020: Trojanized Orion updates are distributed to customers.
- December 2020: FireEye discovers the campaign; CISA issues Emergency Directive 21-01 on 13 December.
- April 2021: The US government formally attributes the attack to Russia’s SVR.
What happened
SolarWinds Orion is software that IT teams use to monitor networks, so it typically runs with broad access. Attackers broke into SolarWinds’ software build process and added a backdoor, later known as SUNBURST, into legitimate Orion updates. Customers installed the updates as normal, because they came from a trusted vendor and were properly signed.
SolarWinds said in a filing that up to about 18,000 customers downloaded the affected updates. The attackers then chose a smaller number of high-value targets, including US federal agencies, for deeper intrusions.
How it was discovered
The campaign came to light in December 2020 when FireEye, a security company, found that its own red team tools had been stolen and traced the intrusion back to Orion. On 13 December 2020, CISA issued Emergency Directive 21-01, ordering federal agencies to immediately disconnect or power down affected Orion products.
Lessons for your organization
- Treat software updates from trusted vendors as a possible risk, especially for tools with broad network access.
- Monitor even trusted tools for unusual outbound connections.
- Limit what monitoring and management tools can access.
- Ask critical software vendors how they secure their build and update process.
- Prepare to rebuild systems if a trusted tool is found to be compromised.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Read our guide to software supply chain security tools. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
What was the SolarWinds hack?
A supply chain attack in which attackers hid a backdoor in SolarWinds Orion software updates, which thousands of organizations installed.
Who was behind the SolarWinds attack?
The US government attributed it to Russia’s foreign intelligence service, the SVR.
How was the SolarWinds attack discovered?
Security firm FireEye discovered it in December 2020 while investigating the theft of its own tools.
