SUNBURST
Associated Software Descriptions |
|
| Name | Description |
|---|---|
| Solorigate | (Citation: Microsoft Deep Dive Solorigate January 2021) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.(Citation: FireEye SUNBURST Backdoor December 2020) |
| .004 | Application Layer Protocol: DNS |
SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.(Citation: FireEye SUNBURST Backdoor December 2020) |
||
| Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic |
SUNBURST used VBScripts to initiate the execution of payloads.(Citation: Microsoft Deep Dive Solorigate January 2021) |
| Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
SUNBURST used Base64 encoding in its C2 traffic.(Citation: FireEye SUNBURST Backdoor December 2020) |
| Enterprise | T1001 | .001 | Data Obfuscation: Junk Data |
SUNBURST added junk bytes to its C2 over HTTP.(Citation: FireEye SUNBURST Backdoor December 2020) |
| .002 | Data Obfuscation: Steganography |
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: FireEye SUNBURST Additional Details Dec 2020)(Citation: Symantec Sunburst Sending Data January 2021) |
||
| .003 | Data Obfuscation: Protocol or Service Impersonation |
SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.(Citation: FireEye SUNBURST Backdoor December 2020) |
||
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.(Citation: FireEye SUNBURST Backdoor December 2020) |
| Enterprise | T1546 | .012 | Event Triggered Execution: Image File Execution Options Injection |
SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process |
| Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.(Citation: FireEye SUNBURST Additional Details Dec 2020) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
SUNBURST had a command to delete files.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020) |
| .007 | Indicator Removal: Clear Network Connection History and Configurations |
SUNBURST also removed the firewall rules it created during execution.(Citation: Microsoft Deep Dive Solorigate January 2021) |
||
| .009 | Indicator Removal: Clear Persistence |
SUNBURST removed IFEO registry values to clean up traces of persistence.(Citation: Microsoft Deep Dive Solorigate January 2021) |
||
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.(Citation: Microsoft Deep Dive Solorigate January 2021) |
| Enterprise | T1027 | .005 | Obfuscated Files or Information: Indicator Removal from Tools |
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.(Citation: CrowdStrike SUNSPOT Implant January 2021) |
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: FireEye SUNBURST Additional Details Dec 2020) |
| Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
SUNBURST was digitally signed by SolarWinds from March - May 2020.(Citation: FireEye SUNBURST Backdoor December 2020) |
| Enterprise | T1218 | .011 | System Binary Proxy Execution: Rundll32 |
SUNBURST used Rundll32 to execute payloads.(Citation: Microsoft Deep Dive Solorigate January 2021) |
| Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.(Citation: Microsoft Analyzing Solorigate Dec 2020) |
| .003 | Virtualization/Sandbox Evasion: Time Based Evasion |
SUNBURST remained dormant after initial access for a period of up to two weeks.(Citation: FireEye SUNBURST Backdoor December 2020) |
||
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0118 | UNC2452 |
(Citation: FireEye SUNBURST Backdoor December 2020) |
|
(Citation: CheckPoint Sunburst & Teardrop December 2020) (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Microsoft Deep Dive Solorigate January 2021) (Citation: FireEye SUNBURST Additional Details Dec 2020) (Citation: SolarWinds Sunburst Sunspot Update January 2021) (Citation: Symantec Sunburst Sending Data January 2021) |
||
| G0016 | APT29 |
(Citation: FireEye SUNBURST Backdoor December 2020) (Citation: MSTIC NOBELIUM May 2021) (Citation: Secureworks IRON RITUAL Profile) |
References
- FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
- MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
- Sudhakar Ramakrishna . (2021, January 11). New Findings From Our Investigation of SUNBURST. Retrieved January 13, 2021.
- Stephen Eckels, Jay Smith, William Ballenthin. (2020, December 24). SUNBURST Additional Technical Details. Retrieved January 6, 2021.
- MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
- Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021.
- Symantec Threat Hunter Team. (2021, January 22). SolarWinds: How Sunburst Sends Data Back to the Attackers. Retrieved January 22, 2021.
- Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021.
- Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.