What Orion was, and why it was worth the trouble

was a monitoring platform: the base on which Network Performance Monitor, Traffic Analyzer, Network Configuration Manager, Server & Application Monitor and their siblings installed, on the customer's own servers. A monitoring server of that kind holds credentials for everything it watches and sits where it can reach every segment, because reaching every segment is its job. Whoever controls it controls a vantage point that no single compromised workstation offers. SolarWinds served over 300,000 customers; about 33,000 of them were Orion customers under maintenance in the period that mattered.

That is the context for the decision the attacker made. Rather than break into 18,000 networks one at a time, they broke into the one company whose software those networks already trusted, and let the 's own update mechanism deliver the implant, signed with the vendor's own certificate.

The timeline, from the company's own account

SolarWinds' chief executive, Sudhakar Ramakrishna, set out the sequence on 11 January 2021. The earliest suspicious activity on the company's internal systems that its forensic teams identified dates from September 2019. The October 2019 version of the Orion Platform release appears to have contained modifications designed to test the perpetrators' ability to insert code into the company's builds: a dry run, with no payload. An updated version of the malicious code injection source then inserted the SUNBURST code into Orion Platform releases starting on 20 February 2020. The perpetrators remained undetected and removed the SUNBURST code from the build environment in June 2020. On 12 December 2020 the company was informed of the attack.

The injection mechanism was identified by KPMG and CrowdStrike working with SolarWinds' own team, and CrowdStrike published its analysis the same day Ramakrishna wrote. The implant, which CrowdStrike named SUNSPOT, ran on the build server and monitored running processes for those involved in compiling the Orion product; when it saw a build, it replaced one of the source files, InventoryManager.cs, with a version carrying the SUNBURST backdoor, then restored the original afterwards. It carried a hash verification check, so that it would only substitute a source file it recognised and never replace one with garbage from a failed decryption, and several safeguards were added to avoid the Orion builds failing, which might have alerted developers to the adversary's presence. CrowdStrike tracked the activity as StellarParticle and, at the time, did not attribute it to any known adversary.

Two things in that account deserve underlining. The source code in SolarWinds' repository was never modified; the substitution happened in memory on the build machine, between the repository and the compiler, so a review of the source would have found nothing. And the attacker tested first, in October 2019, with a harmless change, to learn whether a modified build would ship and whether anyone would notice. Nobody did.

What shipped

FireEye's disclosure of 13 December 2020 described what customers had received. Trojanised updates to SolarWinds Orion business software, digitally signed by SolarWinds, carried a backdoor FireEye called SUNBURST inside SolarWinds.Orion.Core.BusinessLayer.dll, a signed component of the Orion software framework. After an initial dormant period of up to two weeks, the backdoor retrieved and executed commands it called jobs: transfer files, execute files, profile the system, reboot the machine, disable services. It located its command and control server by a domain generation algorithm that built a subdomain of avsvmcloud[.]com, under hosts such as appsync-api.eu-west-1 and appsync-api.us-east-2. In at least one case the attackers then deployed a previously unseen memory-only dropper, TEARDROP, to load Cobalt Strike BEACON. FireEye tracked the actor as UNC2452 and had seen the activity at government, consulting, technology, telecom and extractive entities in North America, Europe, Asia and the Middle East.

The affected releases, in the words of the directive CISA issued the same day, were Orion Platform 2019.4 HF5, 2020.2 RC1 and RC2, 2020.2 and 2020.2 HF1. SolarWinds' own regulatory filing of 14 December put it as updates released between March and June 2020, and gave the number everyone has quoted since: of approximately 33,000 Orion customers that were active maintenance customers during and after the relevant period, fewer than 18,000 were believed to have installed an affected update. The same filing recorded that the company had been made aware of an attack vector used to compromise its e-mail, which may have provided access to other data in its office productivity tools, and promised a second hotfix on or before 15 December. It described the incident as likely the result of a highly sophisticated, targeted and manual supply chain attack by an outside nation state.

The 18,000 needs its caveat every time it is repeated. It is the number of installations that received a backdoor, not the number of organisations the attacker walked into. The backdoor slept for up to two weeks, then asked for instructions, and the actor chose where to proceed. The April 2021 White House statement spoke of the ability to spy on or potentially disrupt more than 16,000 computer systems worldwide; the follow-on intrusions were far fewer and far more selective.

How it was found

Not by SolarWinds, and not by the government. On 8 December 2020 FireEye announced that its own red team tools had been stolen by what it believed to be a state-sponsored attacker, and published countermeasures for them. Investigating how it had been broken into, FireEye found the Orion backdoor, and five days later disclosed it to the world. The National Security Agency, which uses SolarWinds software itself, is not known to have been aware of the attack before FireEye's notification; the attackers had evaded the Department of Homeland Security's Einstein system by using command and control addresses based in the United States and malware that was new. Earlier, during 2019 and 2020, the incident response firm Volexity had watched an attacker it called Dark Halo misuse Microsoft products inside a think tank's network, and in June and July 2020 saw it using the Orion trojan, without being able to identify who it was.

A security company found the largest supply chain attack in history because it looked properly into its own breach. That is the sentence to keep.

The response

CISA's Emergency Directive 21-01, issued on 13 December 2020, told federal civilian agencies what to do, and the order of the instructions is the lesson. First: immediately disconnect or power down SolarWinds Orion products, versions 2019.4 through 2020.2.1 HF1, from the network. Then: forensically image system memory and the host operating systems of every Orion instance; analyse stored network traffic for indications of compromise; block all traffic to and from external hosts where any version of Orion was installed; and report any evidence of compromise to CISA as an incident by noon Eastern on Monday 14 December. Supplemental guidance followed on 6 January 2021 and, as version 4, on 22 April 2021. Disconnect came before patch, because a patched server that had already been used as a foothold was still a foothold.

What the actor did after the backdoor is the part the directive could only hint at. The encyclopaedia's account, drawing on the investigations, is that access to the Orion servers helped the intruders hunt for certificates that would let them sign tokens, so that they could masquerade as legitimate users to on-premises services and to cloud services such as Microsoft's Azure ; vulnerabilities in VMware Access and VMware Identity Manager were used to pivot and persist. The network monitoring server was the door; identity was the house. Victims named in the public record include the United States Treasury and the National Telecommunications and Information Administration in the Department of Commerce. The United Kingdom's National Cyber Security Centre said on 18 December that it was still establishing the impact on the UK, and the Information Commissioner's Office told UK organisations on 23 December to check immediately whether they were affected.

Attribution

FireEye gave the actor a placeholder, UNC2452; Volexity called it Dark Halo; United States officials said the specific group was probably the SVR or Cozy Bear, also known as APT29. On 15 April 2021 the White House made it formal: the United States named the Russian Foreign Intelligence Service, the SVR, also known as APT 29, Cozy Bear and The Dukes, as the perpetrator of the broad-scope cyber espionage campaign that exploited the SolarWinds Orion platform and other information technology infrastructures. The same announcement designated six Russian technology companies that support the Russian intelligence services' cyber programme, sanctioned 32 entities and individuals over attempts to influence the 2020 presidential election, barred United States financial institutions from the primary market for new Russian sovereign debt, and expelled ten personnel from the Russian diplomatic mission in Washington.

The court case about what the company had said

The last chapter is about words rather than code. On 30 October 2023 the Securities and Exchange Commission charged SolarWinds and its chief information security officer, Timothy G. Brown, with fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities, from the company's October 2018 initial public offering through at least its December 2020 announcement. The complaint alleged that the company overstated its cybersecurity practices and understated or failed to disclose known risks, and quoted the company's own people: a 2018 engineer's presentation describing the remote access set-up as not very secure, where someone could do whatever without being detected until it was too late; Brown's own 2018 and 2019 presentations saying the current state of security left the company in a very vulnerable state and that access and privilege to critical systems and data was inappropriate; a June 2020 note that it was very concerning that the back ends were not that resilient; and a September 2020 document warning that the volume of security issues being identified had outstripped the capacity of engineering teams to resolve them. The SEC sought injunctions, disgorgement, civil penalties and a bar on Brown serving as an officer or director.

On 18 July 2024 Judge Paul Engelmayer of the Southern District of New York dismissed most of it. The allegations about SolarWinds' disclosures in its annual and quarterly filings and its 8-K reports were not sufficient to support claims of securities fraud; the press releases and blog posts were non-actionable puffery; and the court categorically rejected the SEC's theory that its authority over internal accounting controls extends to a company's cybersecurity controls, calling those claims ill-pled. What survived were the securities fraud claims based on the Security Statement on the company's website, against both the company and Brown: the court held that misrepresentations about access controls and password protections were undeniably material, because cybersecurity was paramount to the company's business.

So the regulatory outcome, as it stands, is narrow and sharp at once. A company's filings and its marketing were not fraud; the page on its website describing its security practices might be. Every security officer who writes such a page now writes it differently.

What a practitioner should take from it

The build is part of the attack surface. The source was clean. The implant lived on the build server, swapped a file during compilation and put it back. Reproducible builds, build-host integrity and comparing what shipped against what was committed are the controls that would have caught it, and they were rare in 2020.

A signature proves who signed, not what was signed. The SUNBURST DLL carried a valid SolarWinds signature because SolarWinds built and signed it. Code signing is necessary and insufficient; it moves the question from "is this file genuine" to "is the signer's pipeline intact".

The monitoring system is a crown jewel. It holds the credentials, it reaches everything, and its update channel is trusted by definition. Segment it, restrict what it can reach outbound, and treat its vendor's updates with the same suspicion as any other remote code.

Dormancy and selectivity defeat volume defences. Two weeks of silence, then telemetry-shaped traffic to a plausible domain, then a human choosing which of 18,000 doors to open. Behavioural detection in the few networks that were walked through, not signature matching at the perimeter, is what eventually revealed it.

Identity is the second stage. The foothold was a network tool; the objective was the ability to mint SAML tokens and read mail as anyone. Protecting the token-signing keys and watching for impossible authentications matters more than the server the attacker started from.

Disconnect, then image, then patch. The directive's order is the right order for a compromise of a trusted platform, and it is the opposite of the instinct to update first.

Say what you actually do. The legal exposure that survived was not the breach; it was the description of security practices on a public page. Writing those pages truthfully, with the gaps named, is now a securities matter in the United States and a reputational one everywhere.

Sources