Sunspot
Sunspot is an implant that injected the Sunburst backdoor into the SolarWinds Orion software update framework. It was used by UNC2452 since at least February 2020.[1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1134 | Access Token Manipulation |
Sunspot modified its security token to grants itself debugging privileges by adding |
|
Enterprise | T1565 | .001 | Data Manipulation: Stored Data Manipulation |
Sunspot created a copy of the SolarWinds Orion software source file with a |
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
Sunspot decrypts Sunburst, which was stored in AES128-CBC encrypted blobs.[1] |
|
Enterprise | T1480 | Execution Guardrails |
Sunspot only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.[1] |
|
Enterprise | T1083 | File and Directory Discovery |
Sunspot enumerated the Orion software Visual Studio solution directory path.[1] |
|
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Following the successful injection of Sunburst, Sunspot deleted a temporary file it created named |
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
Sunspot was identified on disk with a filename of |
Enterprise | T1106 | Native API |
Sunspot used Windows API functions such as |
|
Enterprise | T1027 | Obfuscated Files or Information |
Sunspot encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for Sunburst source code and data extracted from the SolarWinds Orion |
|
Enterprise | T1057 | Process Discovery |
Sunspot monitored running processes for instances of |
|
Enterprise | T1195 | .002 | Supply Chain Compromise: Compromise Software Supply Chain |
Sunspot malware was designed and used to insert Sunburst into software builds of the SolarWinds Orion IT management product.[1] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0118 | UNC2452 |