The SolarWinds Supply Chain Attack: How UNC2452 Compromised Trusted Software at a Global Scale

On this website, Google uses specific Blogger and Google cookies, including those for Google Analytics and AdSense, as well as other data collected by Google.

 

🛡️ Dear #Network, I would like to introduce you to the SolarWinds supply chain attack.

✏️ In 2020, the SolarWinds cyberattack—also known as Solorigate—became one of the most significant global supply chain attacks ever recorded. It was carried out by a very sophisticated group known as UNC2452.

✏️ The attackers added harmful code to authentic software updates for SolarWinds’ Orion platform. Because the updates were official and digitally signed, they appeared completely legitimate to users.

This attack used a Trojan—a type of malware that looks safe but secretly carries harmful code. In this case, the Trojan was hidden inside a trusted, signed component of the Orion software. It embedded a backdoor, which is an attacker’s technique to keep hidden access to a compromised system after the initial breach.

✏️ Since this malicious code was delivered through signed software that looked trustworthy, it succeeded in compromising many organizations worldwide. Two specific types of malware were discovered: SUNBURST and SUPERNOVA. The fact that the malware was embedded in signed files strongly suggests the attackers had infiltrated SolarWinds' internal software development or distribution systems.

✏️ Even though such attacks are complex, breaking them into smaller parts—like tactics, techniques, and procedures—helps to understand this attack chain.

One widely used approach is the MITRE ATT&CK framework. Its tactics, techniques, and procedures help analyze how attackers operate: how they get into systems (MITRE Reconnaissance techniques), stay hidden (MITRE Defense Evasion techniques), maintain access (MITRE Persistence techniques), and steal data (MITRE Exfiltration techniques). It also explains how the malware created a backdoor, collected system information, and communicated with its operators using command-and-control (C2) servers.

Once the malware was activated, it checked that it was running inside a real company network—not inside a security lab or on a test machine. Then it connected to its C2 server using a subdomain uniquely generated from each infected machine’s details. This made the traffic harder to detect (Defense Evasion).

The backdoor gave attackers full control inside targeted networks. They could map out systems (Reconnaissance), increase access rights (MITRE Privilege Escalation techniques), and move between different parts of the network (MITRE Lateral Movement techniques). These actions were carried out manually by skilled operators, who could then steal sensitive data (Exfiltration), spy, or cause financial loss.

✏️ Protecting against supply chain attacks like this is extremely difficult. One effective method is to share Indicators of Compromise (IOCs)—these are technical pieces of evidence that show a system might have been attacked. In the case of the UNC2452 group, these IOCs are specific to this group. Another method is publishing detection signatures specific to this malware. But even a minor change in malware code will change a signature, and the malware will not be detected.

Another important strategy is using detection queries mapped to MITRE ATT&CK tactics, techniques, and procedures. These help organizations monitor their systems and investigate suspicious activity by drilling into specific MITRE techniques.