Updated January 15, 2021
The U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) have confirmed that malicious threat actors have been and are actively exploiting vulnerabilities in SolarWinds Orion products, specifically affecting versions 2019.4 through 2020.2 HF1. These malware variants are capable of transferring data, file execution, system profiling, rebooting and more.
Both SolarWinds and the CISA strongly suggest that organizations using SolarWinds Orion verify the version they’re running and upgrade immediately, if required. More information can be found at www.solarwinds.com/securityadvisory.
SonicWall Capture Labs threat researchers have investigated the vulnerability and published multiple signatures in different categories that identify malicious activity against affected SolarWinds Orion versions. These mitigations include application identification signatures that detect if an organization has SolarWinds Orion deployed within its network; malicious domain signatures; malicious IPs; and malware such as Sunburst, Supernova and Teardrop.
These signatures are applied automatically to SonicWall firewalls with active security subscriptions.
Application Signatures that identify SolarWinds Orion applications:
IPS Signatures that identify malicious domains:
Gateway antivirus (GAV) signatures that identify malware (Updated January 14):
Sunburst: A backdoor malware that has been trojanized into multiple SolarWinds Orion update versions.
Supernova: A webshell planted in the code of the Orion network and applications monitoring platform and enabled adversaries to run arbitrary code on machines using the trojanized versions of the Orion software.
Teardrop: A memory-only dropper that runs as a service.
Blocked Domains (Updated January 15):
SonicWall products and real-time security services can help organizations identify Sunburst, Supernova and Teardrop malware and other attacks against vulnerable SolarWinds Orion versions.
To verify you have the latest SonicWall Intrusion Prevention Signatures (IPS), please follow the steps in this knowledge base (KB) article: https://www.sonicwall.com/support/knowledge-base/detailed-information-on-intrusion-prevention-signature-ips-signature-ids/170505742887527/
Additional details regarding this vulnerability can be found in this SonicAlert: https://securitynews.sonicwall.com/xmlpost/solarwinds-orion-vulnerability/