bitsIO MSSP services has learned of the active exploitation of SolarWinds Orion Platform to distribute the SUNBURST malware. The malware campaign has been successful in multiple high profile organizations. Below is the announcement from US Cybersecurity and Infrastructure Agency:
What you should do at this point:
- Verify if you are running SolarWinds Orion version 2019.4 through 2020.2.1HF1 and if so, assert which networks are managed by it (likely all or most of your network)
- CISA recommends disconnecting/powering down affected versions of SolarWinds Orion but if this is not possible then follow the steps in the Solarwinds Advisory
- bitsio has begun to configure Splunk to detect SUNBURST Indicators of Compromise (IOC) and will alert on detection. The following IOC’s have been published:
(1) is SolarWinds.Orion.Core.BusinessLayer.dll present? It may be located in %PROGRAMFILES%\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll or
%WINDIR%\System32\config\systemprofile\AppData\Local\assembly\tmp\<VARIES>\SolarWinds.Orion.Core.BusinessLayer.dll
(2) if so, the malicious version uses this Singer and SingerHash:
“Signer”: “Solarwinds Worldwide LLC”
“SignerHash”: “47d92d49e6f7f296260da1af355f941eb25360c4”
(3) the existence of the file C:\WINDOWS\SysWOW64\netsetupsvc.dll may indicate a compromise
(4) check for outbound traffic to hostnames in the avsvmcloud.com domain (e.g. review DNS logs) - Ensure malware protection solutions are updated with the latest signatures.
bitsIO will continue to monitor this situation and will alert our customers through our established communication channels.
