Security Advisory – Active Exploitation of Solarwinds Orion Platform Compromise
bitsIO MSSP services has learned of the active exploitation of SolarWinds Orion Platform to distribute the SUNBURST malware. The malware campaign has been successful in multiple high profile organizations. Below is the announcement from US Cybersecurity and Infrastructure Agency:
Click to visit CISA Advisory page
What you should do at this point:
Verify if you are running SolarWinds Orion version 2019.4 through 2020.2.1HF1 and if so, assert which networks are managed by it (likely all or most of your network)
CISA recommends disconnecting/powering down affected versions of SolarWinds Orion but if this is not possible then follow the steps in the Solarwinds Advisory
bitsio has begun to configure Splunk to detect SUNBURST Indicators of Compromise (IOC) and will alert on detection. The following IOC’s have been published: (1) is SolarWinds.Orion.Core.BusinessLayer.dll present? It may be located in %PROGRAMFILES%\SolarWinds\Orion\SolarWinds.Orion.Core.BusinessLayer.dll or %WINDIR%\System32\config\systemprofile\AppData\Local\assembly\tmp\<VARIES>\SolarWinds.Orion.Core.BusinessLayer.dll (2) if so, the malicious version uses this Singer and SingerHash: “Signer”: “Solarwinds Worldwide LLC” “SignerHash”: “47d92d49e6f7f296260da1af355f941eb25360c4” (3) the existence of the file C:\WINDOWS\SysWOW64\netsetupsvc.dll may indicate a compromise (4) check for outbound traffic to hostnames in the avsvmcloud.com domain (e.g. review DNS logs)
Ensure malware protection solutions are updated with the latest signatures.
bitsIO will continue to monitor this situation and will alert our customers through our established communication channels.
This website uses cookies to ensure you get the best experience on our website. ACCEPT
Privacy & Cookies Policy
Privacy Overview
This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.