Last updated 3 weeks ago
SolarWinds, a major IT infrastructure management software provider, experienced a sophisticated supply chain compromise affecting its Orion platform. The breach was discovered and disclosed in December 2020, impacting thousands of organizations globally including multiple government agencies and Fortune 500 companies. The attack compromised SolarWinds' software build system, allowing malicious actors to distribute trojanized updates to approximately 18,000 customers.
The attack chain began with unauthorized access to SolarWinds' development environment, where attackers inserted malicious code into legitimate Orion software updates. This created a backdoor (SUNBURST) that communicated with command-and-control infrastructure, enabling lateral movement and data exfiltration from affected networks. The compromise specifically targeted the SolarWinds.Orion.Core.BusinessLayer.dll binary, which was digitally signed with SolarWinds certificates, making detection more difficult.
Multiple government agencies including the United States Cybersecurity and Infrastructure Security Agency (CISA) issued emergency directives requiring federal agencies to disconnect affected Orion products. The incident triggered widespread security reviews across affected organizations, with mandatory software updates and network segmentation implemented as containment measures. SolarWinds released security advisories and patches while conducting forensic investigations with third-party cybersecurity firms.
Malicious code inserted into SolarWinds Orion software updates, creating a backdoor for attackers
Delaware Supreme Court reversed a lower court decision, allowing cyber insurers to proceed with a collective subrogation claim against Blackbaud based on breach of contract.
The SolarWinds compromise demonstrates critical failures in software supply chain security controls, particularly inadequate code integrity verification and insufficient segmentation between development and production environments. Organizations must implement robust software bill of materials (SBOM) practices and continuous monitoring of third-party software updates, especially for critical infrastructure management tools. The incident highlights the need for zero-trust architectures that assume compromise and limit lateral movement even from trusted software sources.
Sign in to join the discussion.
Company
Industry
Location
Discovered
Disclosed
Records Affected
Attack Vector