SolarWinds Orion Vulnerability

First Published:12/15/2020

Last Updated:01/15/2021

Updated January 15, 2021

The U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) have confirmed that malicious threat actors have been and are actively exploiting vulnerabilities in SolarWinds Orion products, specifically affecting versions 2019.4 through 2020.2 HF1. These malware variants are capable of transferring data, file execution, system profiling, rebooting and more.

Both SolarWinds and the CISA strongly suggest that organizations using SolarWinds Orion verify the version they’re running and upgrade immediately, if required. More information can be found at www.solarwinds.com/securityadvisory.

SonicWall Capture Labs threat researchers have investigated the vulnerability and published multiple signatures in different categories that identify malicious activity against affected SolarWinds Orion versions. These mitigations include application identification signatures that detect if an organization has SolarWinds Orion deployed within its network; malicious domain signatures; malicious IPs; and malware such as Sunburst, Supernova and Teardrop.

These signatures are applied automatically to SonicWall firewalls with active security subscriptions.

Application Signatures that identify SolarWinds Orion applications:

15296: BUSINESS-APPS SolarWinds Orion (API Activity)
2014: BUSINESS-APPS SolarWinds Orion (Update Activity)

IPS Signatures that identify malicious domains:

15292: SolarWinds Supply Chain Malware Activity 1
15293: SolarWinds Supply Chain Malware Activity 2
15294: SolarWinds Supply Chain Malware Activity 3
15295: SolarWinds Supply Chain Malware Activity 4
15298: SolarWinds Supply Chain Malware Activity 5
15299: SolarWinds Supply Chain Malware Activity 6
15300: SolarWinds Supply Chain Malware Activity 7
15301: SolarWinds Supply Chain Malware Activity 8
15302: SolarWinds Supply Chain Malware Activity 9
15303: SolarWinds Supply Chain Malware Activity 10
15308: SolarWinds Supply Chain Malware Activity 11
15309: SolarWinds Supply Chain Malware Activity 12
15310: SolarWinds Supply Chain Malware Activity 13
15311: SolarWinds Supply Chain Malware Activity 14
15312: SolarWinds Supply Chain Malware Activity 15
15313: SolarWinds Supply Chain Malware Activity 16
15314: SolarWinds Supply Chain Malware Activity 17
15315: SolarWinds Supply Chain Malware Activity 18
15316: SolarWinds Supply Chain Malware Activity 19
15317: SolarWinds Supply Chain Malware Activity 20

Gateway antivirus (GAV) signatures that identify malware (Updated January 14):

Sunburst: A backdoor malware that has been trojanized into multiple SolarWinds Orion update versions.

SunBurst.A (Trojan) IOC:d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
SolarWinds.DL (Trojan), IOC:ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
SunBurst.A_1 (Trojan), IOC:32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
SunBurst.A_2 (Trojan), IOC:ad2fbf4add71f61173975989d1a18395afb8538ed889012b9d2e21c19e98bbd1

Supernova: A webshell planted in the code of the Orion network and applications monitoring platform and enabled adversaries to run arbitrary code on machines using the trojanized versions of the Orion software.

Injector.DN_35 (Trojan) IOC:c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
Supernova.A_1 (Trojan), IOC:1c96021ac8cb52173e762f6b008fb4c6e5ef113e6baa4e2cf4848e88c61d9700

Teardrop: A memory-only dropper that runs as a service.

Teardrop.B (Trojan), IOC:6e4050c6a2d2e5e49606d96dd2922da480f2e0c70082cc7e54449a7dc0d20f8d

Blocked Domains (Updated January 15):

avsvmcloud.com
digitalcollege.org
freescanonline.com
deftsecurity.com
thedoccloud.com
virtualdataserver.com
incomeupdate.com
databasegalore.com
panhardware.com

SonicWall products and real-time security services can help organizations identify Sunburst, Supernova and Teardrop malware and other attacks against vulnerable SolarWinds Orion versions.

To verify you have the latest SonicWall Intrusion Prevention Signatures (IPS), please follow the steps in this knowledge base (KB) article: https://www.sonicwall.com/support/knowledge-base/detailed-information-on-intrusion-prevention-signature-ips-signature-ids/170505742887527/

Additional details regarding this vulnerability can be found in this SonicAlert: https://securitynews.sonicwall.com/xmlpost/solarwinds-orion-vulnerability/

Previous Alert

SonicWall DoS & XSS Vulnerabilities

Next Alert

Security Notice: SonicWall Email Security Zero-Day Vulnerabilities

SolarWinds Orion Vulnerability

Follow Us

Subscribe to newsletter

Stay In Touch