If the SUPERNOVA web shell is discovered on your SolarWinds installations, it should be treated separately from Sunburst. SolarWinds-Sunburst-Solorigate-Supernova-FireEye. SolarWinds was the victim of a cyberattack that inserted a vulnerability into its Orion Software which, if present, could potentially allow an attacker to compromise the server on which the Orion products run. The shell has the ability to be implemented on upatched or exposed online SolarWinds’ Orion platforms. Sunburst: Supply Chain Attack Targets SolarWinds Users A number of Symantec customers affected by wide-ranging trawl for potential targets of interest.
SOLARWINDS SUPERNOVA UPGRADE
SolarWinds issued a security advisory recommending users upgrade to the latest version, Orion Platform version 2020.2.1 HF 1, as soon as possible. federal civilian agencies to review their networks for indicators of compromise (IOCs) and … These include the SUNBURST backdoor, SUPERNOVA, COSMICGALE & TEARDROP. Department of Homeland Security (DHS) and CISA issued an emergency alert calling on all U.S.
What makes the newly revealed malware, dubbed "Supernova," different is that unlike the Sunburst DLL, Supernova ("app_web_") is not signed with a legitimate SolarWinds digital certificate, signaling that the compromise may be unrelated to the previously disclosed supply chain attack. Resources related to the SolarWinds supply chain breach, connected to the FireEye breach, that identified Sunburst and Supernova.
SOLARWINDS SUPERNOVA UPDATE
UPDATE Decem: Our blog has been updated with analysis of the Teardrop second-stage malware and an example of the post-compromise attack chain. On December 13, 2020, the Cybersecurity & Infrastructure Agency (CISA) released Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise. Introduction The recent SolarWinds’ Orion supply chain attack has proven to be one of the most layered and damaging attacks of 2020, consisting of multiple artifacts and sophisticated TTPs.
In fact, the vulnerability is classified as CVE-2019-8917.
0 kommentar(er)
