The DHS’ Cybersecurity and infrastructure Security Agency has launched a website providing resources related to the ongoing cyber activities of the advanced persistent threat (APT) group responsible for compromising the SolarWinds Orion software supply chain.
The threat actors behind the attack gained access to the networks of federal, state, and local governments, critical infrastructure entities, and private sector organizations around the world. In addition to compromising the software update mechanism of SolarWinds Orion, the hackers also exploited vulnerabilities in commonly used authentication mechanisms to gain persistent access to networks.
According to Microsoft, the main goal of the attackers appears to be to gain persistent local access to networks by delivering the Sunburst/Solarigate backdoor, then pivot to victims’ cloud assets. Recently it has become clear that more than one threat group is conducting cyber espionage after the discovery of a different malware variant that was introduced through the SolarWinds Orion software update feature. Microsoft and Palo Alto Networks believe the second malware variant, named Supernova, is not associated with the group that deployed the Sunburst/Solarigate backdoor.
Several resources have already been published to help organizations assess the risk associated with the cyber activity and detect and mitigate potential breaches and eliminate the threat actors from their networks. The new website pools the resources and provides easy access to pertinent information on this global incident. The website will be regularly updated as new information becomes available as the investigations into the cyber activity continue.
The APT actor has compromised the networks of a large number of entities and is selectively choosing targets of interest for further network exploitation, but any organization that has installed the compromised software updates is at risk if corrective action is not taken.
It is important for all organizations that use SolarWinds Orion to take action to investigate for signs of compromise. As CISA explained in its latest alert, “If left unchecked, this threat actor has the resources, patience, and expertise to resist eviction from compromised networks and continue to hold affected organizations at risk.” CISA also points out that even if entities have not installed the compromised SolarWinds Orion update, that does not necessary mean they will not be affected. Their managed service providers and partners may have been compromised, which could give the APT actor access to their networks.
The website includes a link to a free tool that has been released by CISA for detecting unusual and potentially malicious activity in Azure/Microsoft Office 365 environments. The new tool provides a narrowly focused view of activity related to the identity- and authentication-based attacks that have been observed across a wide range of sectors following the deployment of the Sunburst/Solarigate backdoor.
The tool – named Sparrow – can be used to narrow down large data sets of investigation modules and telemetry to provide information specific to the attacks on federated identity sources and applications.
The post CISA Launches SolarWinds Supply Chain Compromise Website and Free Malicious Activity Detection Tool appeared first on HIPAA Journal.