Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The SUNBURST backdoor is part of a supply-chain attack that affects public and private organizations around the world. Attackers designed and distributed this backdoor through sophisticated advanced persistent threat (APT) techniques. The SUNBURST backdoor can give attackers direct access to network traffic management systems.
Kill Chain
Risk Score
94
The backdoor known as SUNBURST or Solorigate is installed on servers running Orion software through a SolarWinds Orion Platform trojan update file, which includes a malicious DLL file. After installation, the SUNBURST backdoor attempts to resolve a domain, such as avsvmcloud, for a command-and-control (C&C) server. After establishing a connection, the backdoor retrieves and then runs commands for transferring files, running files, collecting system information, rebooting a device, or disabling system services. Several techniques, such as appearing as the Orion Improvement Program (OIP) protocol, enable malicious traffic to blend in with normal SolarWinds network traffic.
