Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?



SolarWinds Says 18,000 Customers May Have Used Compromised Orion Product

SolarWinds’ investigation into the recent attacks that leveraged its products to target government and private sector organizations revealed that 18,000 customers may have used the compromised products, the company said in a filing with the Securities and Exchange Commission (SEC) on Monday.

SolarWinds’ investigation into the recent attacks that leveraged its products to target government and private sector organizations revealed that 18,000 customers may have used the compromised products, the company said in a filing with the Securities and Exchange Commission (SEC) on Monday.

The IT management and monitoring solutions provider has confirmed reports that threat actors compromised the software build system for its Orion monitoring platform and leveraged that access to deliver trojanized updates to customers between March and June 2020. The vendor says the attacker could have exploited the introduced vulnerability to compromise the server running the Orion product.

SolarWinds says it has notified roughly 33,000 Orion customers of the incident, but the firm believes that in reality “fewer than 18,000” customers may have used the compromised version of its products.SolarWinds hacked

It also noted that it detected an attack targeting its Microsoft Office 365 email and productivity systems, but the company is still trying to determine if this incident is related to the Orion hack, and claims that it has found no evidence that data was exfiltrated.

SolarWinds has released a hotfix and by December 15 it expects to release another update that will replace the compromised component and provide additional security enhancements. The company pointed out that there is no evidence that other products are impacted, and noted that only products downloaded, implemented or updated between March and September contained the vulnerability. The source code repository of the Orion products was apparently not compromised.

FireEye, which is one of the companies that was apparently targeted in the campaign involving the SolarWinds exploit, reported observing multiple victims, including government, technology, consulting, extractive and telecom organizations in North America, Europe, the Middle East and Asia.

Several U.S. government organizations were also hit, including the Treasury and Commerce department, and Reuters reported on Monday that the hackers also gained access to internal communications at the Department of Homeland Security (DHS).

However, in its SEC filing, SolarWinds noted that it “is still investigating whether, and to what extent, a vulnerability in the Orion products was successfully exploited in any of the” attacks reported by the media.

According to its website, SolarWinds has more than 300,000 customers worldwide, including over 425 of U.S. Fortune 500 companies, all the biggest telecoms firms in the United States, the U.S. Military, the State Department, the Pentagon, the NSA, and the Department of Justice.

Advertisement. Scroll to continue reading.

The DHS issued an emergency directive on Sunday, instructing federal agencies to immediately look for signs of a breach, collect forensic evidence for an investigation, and take steps to lock the attackers out.

A Russian state-sponsored threat actor is reportedly behind this campaign — the group tracked as APT29 and Cozy Bear seems to be the main suspect. Russia has denied the allegations in a statement published by its U.S. embassy on Sunday.

FireEye, which tracks the attacker as UNC2452, said the hackers used the trojanized SolarWinds software to deliver a backdoor named SUNBURST and, in at least some cases, deliver other previously unknown payloads.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

Professional services company Slalom has appointed Christopher Burger as its first CISO.

More People On The Move

Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.