Security Experts:

Connect with us

Hi, what are you looking for?


Cloud Security

CISA Says Many Victims of SolarWinds Hackers Had No Direct Link to SolarWinds

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says many of the victims of the threat group that targeted Texas-based IT management firm SolarWinds were not directly linked to SolarWinds.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says many of the victims of the threat group that targeted Texas-based IT management firm SolarWinds were not directly linked to SolarWinds.

“While the supply chain compromise of SolarWinds first highlighted the significance of this cyber incident, our response has identified the use of multiple additional initial infection vectors. We have found that significant numbers of both the private-sector and government victims linked to this campaign had no direct connection to SolarWinds,” a CISA spokesperson told SecurityWeek.

“This is an ongoing response, and we are still working with our government and private sector partners to fully understand this campaign, and to develop and share timely information to mitigate the threat posed by this adversary,” the agency said.

CISA’s acting director, Brandon Wales, told The Wall Street Journal last week that roughly 30% of the victims identified by the agency did not have a direct connection to SolarWinds. Wales also said some victims were compromised before SolarWinds started delivering malicious product updates to customers.

CISA warned shortly after the SolarWinds breach came to light that the supply chain compromise was not the only initial attack vector leveraged by the threat group, which the U.S. government and others have linked to Russia.

Threat intelligence and incident response firm Volexity reported that the same group, which it tracks as Dark Halo, hacked a U.S. think tank several times, but only one of their attack waves exploited the compromised SolarWinds supply chain.

Continuous Updates: Everything You Need to Know About the SolarWinds Attack

The attackers have also been known to target organizations through Microsoft services and WSJ cited a person familiar with the SolarWinds investigation saying that SolarWinds has been trying to determine if its own network was initially breached through Microsoft services. Microsoft confirmed back in December that it had found some of the malicious SolarWinds files on its systems, but said it had found no evidence that its own systems were leveraged to target others.

Wales said Microsoft was the only cloud provider whose services were abused by the hackers and it did not appear that there was any other supply chain compromise aside from the one targeting SolarWinds.

Microsoft has been informing some companies that they have been targeted by the SolarWinds hackers through its cloud services. The list includes cybersecurity firms Malwarebytes, Mimecast and CrowdStrike (CrowdStrike said it was targeted, but claimed it was not impacted).

Other cybersecurity firms targeted by the attackers or impacted to some extent include Palo Alto Networks, FireEye, Qualys and Fidelis Cybersecurity. Malwarebytes said it had not used any SolarWinds products, while Qualys and Fidelis said they received the malicious software updates pushed out by the attackers due to the fact that they had been analyzing the software.

CISA did not clarify whether victims with “no direct connection to SolarWinds” included organizations that had received the malicious updates but did not actually use the software.

SolarWinds said the malicious updates, which targeted its Orion monitoring product, were sent to roughly 18,000 customers, but investigations conducted to date revealed that only a few hundred government and private sector organizations actually presented an interest to the attackers and received secondary payloads.

Related: SolarWinds Hackers Used ‘Raindrop’ Malware for Lateral Movement

Related: Biden Orders Intelligence Agencies to Assess SolarWinds Hack

Related: Hundreds of Industrial Organizations Received Sunburst Malware in SolarWinds Attack

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.