Advisory |
Adversarial Intelligence |
Threat Actor |
UNC2452 |
Vector |
Supply Chain |
Vendor |
SolarWinds |
A sophisticated threat actor dubbed UNC2452 compromised one of the modules in the SolarWinds Orion IT monitoring and management System. They planted a backdoor specifically in DynamicLinkedLibrary named SolarWinds.Orion.Core.BusinessLayer.dll, loaded by following .NET executables [based on system configuration]:
This new campaign uses a “memory-only” dropper named TEARDROP to deploy a modified Cobalt Strike Beacon onto the victim for command and control (C2).
The trojanized component is available for download as a part of the following legitimate update:
hxxp://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20574/SolarWinds-Core-v2019.4.5220-Hotfix5.msp
C2 communications are safely embedded as part of SolarWinds communication protocol called Orion Improvement Program Protocol, to evade security and as part of operational security. The domain used for C2 is avsvmcloud.com
A Domain Generation Algorithm is used to construct and resolve the subdomain of avsvmcloud.com The malware kills security and forensic services running on the target system, using a block list. The block list contains a list of services linked to AV/EDR/XDR vendors and other forensics related tools.
The payload connects to the C2 server after connection to the domain api.solarwinds.com is established. The subdomains are linked together with one of the following domains to create hostname to resolve:
Technique |
Tactics |
|
Resource Development | T1584 | Compromise Infrastructure |
Initial Access | T1195.002 | Compromise Software Supply Chain |
Execution | T1569.002 | Service Execution |
Persistence/Privilege Escalation | T1543.003 | Windows Service |
Defense Evasion | T1027 | Obfuscated Files or Information |
T1070.004 | File Deletion | |
T1553.002 | Code Signing | |
Discovery | T1012 | Query Registry |
T1057 | Process Discovery | |
T1083 | File and Directory Discovery | |
T1518 | Software Discovery | |
T1518.001 | Security Software Discovery | |
Command and Control | T1071.001 | Web Protocols |
T1071.004 | Application Layer Protocol: DNS | |
T1105 | Ingress Tool Transfer | |
T1132.001 | Standard Encoding | |
T1568.002 | Domain Generation Algorithms |
https://github.com/fireeye/sunburst_countermeasures