CERT Advisory - SUNBURST / Solorigate (aka, SolarWinds Hacking)

US Agencies and FireEye were hacked using SolarWinds software backdoor.

▶ Related news articles

SEC filings: SolarWinds says 18,000 customers were impacted by recent hack (ZDNet)

Microsoft, FireEye confirm SolarWinds supply chain attack (ZDNet)

US Agencies and FireEye Were Hacked Using SolarWinds Software Backdoor (The Hacker News)

US govt, FireEye breached after SolarWinds supply-chain attack (Bleeping Computer)

Security Researcher Reveals Solarwinds' Update Server Was 'Secured' With The Password 'solarwinds123' (techdirt)

Microsoft’s Role In SolarWinds Breach Comes Under Scrutiny (CRN)

SolarWinds hackers breach US nuclear weapons agency (Bleeping Computer)

▶ CISA's advisory

Active Exploitation of SolarWinds Software

• SolarWinds Security Advisory
• FireEye Advisory: Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
• FireEye GitHub page: Sunburst Countermeasures

CISA Publishes Eviction Guidance for Networks Affected by SolarWinds and AD/M365 Compromise

▶ Advisories / IOCs

▷ FireEye

The CVEs related to the Red Team tools
FireEye Shares Details of Recent Cyber Attack, Actions to Protect Community

Unauthorized Access of FireEye Red Team Tools

FireEye’s GitHub repository: Red Team Tool Countermeasures

CommandoVM

IOCs

Solarwinds Supply Chain Attack (Security Onion)

▷ Microsoft

Microsoft: Solorigate supply chain attack diagram

Trojan:MSIL/Solorigate.B!dha

Behavior:Win32/Solorigate.C!dha

Customer Guidance on Recent Nation-State Cyber Attacks

▶ TTPs

Tactics, Techniques and Procedures (TTPs) Utilized by FireEye’s Red Team Tools (Picus Security)

It is Time to Take Action - How to Defend Against FireEye’s Red Team Tools (Picus Security)

Picus Lab's Github repository (security vendor signatures)

Dark Halo Leverages SolarWinds Compromise to Breach Organizations (Volexity)

New Evidence Suggests SolarWinds' Codebase Was Hacked to Inject Backdoor (The Hacker News)

▶ Analysis Report

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop (Microsoft)

SUNBURST Additional Technical Details (FireEye)

CISA Malware Analysis Report (AR21-039A)