SUPERNOVA Web Shell

Attackers exploit a SolarWinds Orion API authentication bypass vulnerability to install the SUPERNOVA malware, which is a .NET web shell. The web shell can disguise C&C activity by impersonating a SolarWinds web service that retrieves logo images. The web shell also leverages the SolarWinds .NET library to compile code on the victim. When the attacker wants to run a command on the victim, the attacker sends an HTTP request for the logoimagehandler.ashx resource with custom parameters: args, clazz, codes, and method. These parameters enable the malware to compile and run the malicious code. After the code runs, the victim sends an HTTP response to the attacker with the status code of 200 and the content-type of "text/plain". SUPERNOVA malware is unsigned, differentiating it from the SUNBURST supply-chain attack on the SolarWinds Orion Platform.