SolarWinds’ investigation into the recent attacks that leveraged its products to target government and private sector organizations revealed that 18,000 customers may have used the compromised products, the company said in a filing with the Securities and Exchange Commission (SEC) on Monday.
The IT management and monitoring solutions provider has confirmed reports that threat actors compromised the software build system for its Orion monitoring platform and leveraged that access to deliver trojanized updates to customers between March and June 2020. The vendor says the attacker could have exploited the introduced vulnerability to compromise the server running the Orion product.
SolarWinds says it has notified roughly 33,000 Orion customers of the incident, but the firm believes that in reality “fewer than 18,000” customers may have used the compromised version of its products.
It also noted that it detected an attack targeting its Microsoft Office 365 email and productivity systems, but the company is still trying to determine if this incident is related to the Orion hack, and claims that it has found no evidence that data was exfiltrated.
SolarWinds has released a hotfix and by December 15 it expects to release another update that will replace the compromised component and provide additional security enhancements. The company pointed out that there is no evidence that other products are impacted, and noted that only products downloaded, implemented or updated between March and September contained the vulnerability. The source code repository of the Orion products was apparently not compromised.
FireEye, which is one of the companies that was apparently targeted in the campaign involving the SolarWinds exploit, reported observing multiple victims, including government, technology, consulting, extractive and telecom organizations in North America, Europe, the Middle East and Asia.
Several U.S. government organizations were also hit, including the Treasury and Commerce department, and Reuters reported on Monday that the hackers also gained access to internal communications at the Department of Homeland Security (DHS).
However, in its SEC filing, SolarWinds noted that it “is still investigating whether, and to what extent, a vulnerability in the Orion products was successfully exploited in any of the” attacks reported by the media.
According to its website, SolarWinds has more than 300,000 customers worldwide, including over 425 of U.S. Fortune 500 companies, all the biggest telecoms firms in the United States, the U.S. Military, the State Department, the Pentagon, the NSA, and the Department of Justice.
The DHS issued an emergency directive on Sunday, instructing federal agencies to immediately look for signs of a breach, collect forensic evidence for an investigation, and take steps to lock the attackers out.
A Russian state-sponsored threat actor is reportedly behind this campaign — the group tracked as APT29 and Cozy Bear seems to be the main suspect. Russia has denied the allegations in a statement published by its U.S. embassy on Sunday.
FireEye, which tracks the attacker as UNC2452, said the hackers used the trojanized SolarWinds software to deliver a backdoor named SUNBURST and, in at least some cases, deliver other previously unknown payloads.