Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Over 250 Organizations Breached via SolarWinds Supply Chain Hack: Report

It is believed that the recently disclosed attack targeting Texas-based IT management solutions provider SolarWinds resulted in threat actors gaining access to the networks of more than 250 organizations, according to reports.

It is believed that the recently disclosed attack targeting Texas-based IT management solutions provider SolarWinds resulted in threat actors gaining access to the networks of more than 250 organizations, according to reports.

The New York Times reported over the weekend that the SolarWinds supply chain attack is believed to have impacted as many as 250 government agencies and businesses.

It was previously revealed that the list of victims included major tech companies such as Microsoft, Cisco and VMware, and U.S. government agencies such as the State Department, Commerce Department, Treasury, DHS, and the National Institutes of Health.

Microsoft admitted recently that the attackers gained access to some of its source code, but the company claimed they couldn’t have made any modifications to the code.

The New York Times also learned that some SolarWinds software is maintained in Eastern Europe and investigators in the U.S. are now trying to determine if the breach originated there.

This link to Eastern Europe has raised some concerns considering that many believe the attack was conducted by hackers connected to Russian intelligence.

In the meantime, SolarWinds continues to share updates regarding its investigation into the incident. The supply chain attack involved the use of trojanized updates for the company’s Orion monitoring product in an effort to deliver, among other things, a piece of malware named SUNBURST.

However, investigations revealed the existence of a different piece of malware, named SUPERNOVA, that may have been used by a different threat actor as part of an operation that may not be related to the supply chain attack.

Advertisement. Scroll to continue reading.

SolarWinds and others are trying to determine if SUPERNOVA, whose delivery involved exploitation of a zero-day vulnerability, is connected to SUNBURST. In its latest update, the company said it does “not have a definitive answer at this time” regarding SUNBURST and SUPERNOVA possibly being related.

On December 18, shortly after the SolarWinds breach came to light, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive instructing federal agencies to immediately take steps to detect, investigate and respond to potential intrusions. On December 30, CISA issued supplemental guidance to help government organizations mitigate the threat.

Related: Group Behind SolarWinds Hack Bypassed MFA to Access Emails at US Think Tank

Related: SolarWinds Likely Hacked at Least One Year Before Breach Discovery

Related: SolarWinds Claims Execs Unaware of Breach When They Sold Stock

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...