An analysis of publicly available web records shows SolarWinds hackers accessed the networks at Cox Communications and the local government in Pima County, AZ
including the highest reaches of the U.S. government — is certain of exactly what the hackers had infiltrated, let alone the full extent of what was taken. https://www.bloomberg.com/... William Turton / @williamturton : New: Members of a consortium of major financial firms that share cybersecurity information with each other and the government, expressed concern the the US govt could be so deeply penetrated that its confidential data could be seen by Russian hackers: https://www.bloomberg.com/... https://twitter.com/...
The finding lands amid a wider scramble to map the intrusion: investigators are now examining [[a:961628|whether SolarWinds was hacked through its engineering offices in Czechia, Poland, and Belarus]], while members of a financial-sector information-sharing consortium have warned the U.S. government's penetration may be deep enough that confidential data was visible to Russian-linked hackers.
First-order effects
Cox Communications and Pima County join Treasury on the list of confirmed victims, forcing both to scope what was accessed on networks they did not know were compromised via software they had legitimately installed.
SolarWinds faces a customer-trust problem across its 300,000+ customer base, as each new confirmed victim — public or private — widens the perceived exposure of its Orion product line.
Second-order effects
Every organization running the affected SolarWinds product now has to assume compromise until proven otherwise, shifting security teams from patch-and-move-on to full forensic review of months of network history.
The confirmed reach into a cable operator and a county government pressures other SolarWinds customers — utilities, state agencies, enterprises — to disclose their own exposure, and pushes buyers toward vendors with more transparent engineering footprints.
Third-order effects
If the pattern holds — one compromised vendor yielding access across government, telecom, and local government — software supply chains become the primary target for nation-state espionage, and vendor engineering locations (like the Eastern Europe offices now under investigation) become part of national-security review.
The difficulty investigators face in establishing exactly what was taken, even at the highest levels of government, points toward structural changes in how federal agencies and critical infrastructure operators vet and monitor third-party software.
The trend: Nation-state espionage is shifting from direct network attacks to poisoning trusted software vendors, where a single compromise cascades across government, telecom, and local-government victims simultaneously.
Gotta appreciate that multiple hackers were targeting these guys and they made it extra easy by leaving “solarwinds123” as a password to access their update server https://www.reuters.com/...
@kimzetter
Kim Zetter on x
New: SolarWinds hackers did test-run of spy operation in Oct 2019, when malicious SolarWinds files were first downloaded by customers. That version didn't have backdoor in it, however. Indicates hackers were in SolarWinds network in 2019, if not earlier. https://news.yahoo.com/..…
@craiu
Costin Raiu on x
We are releasing some new findings in the #Solarwinds #Sunburst #darkhalo #unc2452 story. Our analysis plus an opensource tool that decodes and matches the UIDs from the CNAME records against publicly available pDNS data: https://securelist.com/...
@dangoodin001
Dan Goodin on x
Of the 18,000 customers who downloaded a backdoored Orion update, only a few dozen, or about 0.2%, of them received a follow on attack, according to Microsoft telemetry. This super elite group was 44% tech cos, 18% gov agencies and 18% think tanks/NGOs. https://arstechnica.com/..…
@kevincollier
Kevin Collier on x
This is a slightly weird framing for how the US is thinking of attribution for the SolarWinds campaign, but I can assure you that plenty of legislators who get briefed on cyber matters miss some of the nuance of how to talk about it, esp when unclassified. https://twitter.com/...
@diakopter
@diakopter on x
@thespybrief “The DOJ, FBI and DOD..., have moved routine communication onto classified networks that are believed not to have been breached, according to two people briefed on the measures. They are assuming that the non-classified networks have been accessed” https://www.reuter…
@kaspersky
@kaspersky on x
While the #SolarWinds Orion IT packages reached about 18,000 customers, only a handful of these was interesting to the attackers referred to as UNC2452 or DarkHalo. @craiu and @2igosha share new findings on @Securelist. https://kas.pr/k75e https://twitter.com/...
@e_kaspersky
Eugene Kaspersky on x
#Sunburst: connecting the dots in the DNS requests ⇒ https://kas.pr/j5yo TL;DR Three of the requests from FireEye's Github repository can be mapped to two domain names that belong to a government organization and a telecommunications company in the US. https://twitter.com/...
@lululemew
@lululemew on x
LONDON (Reuters) - Suspected Russian hackers accessed the systems of internet provider, Cox Communications & the local government in Pima County, AZ as part of sprawling cyber-espionage campaign https://www.reuters.com/...
@bambenek
John Bambenek on x
Some more updates on the Sunburst/Solarwinds breach. We have found what looks like at least two targets of interest based on my research and research by @kaspersky https://www.reuters.com/...
@profwoodward
Alan Woodward on x
This kind of passive DNS work and analysis of the malware now released is what will lead to identifying where the Sunburst attacks came from - it's a slow process https://securelist.com/...
@carter_pe
Phillip Carter on x
“The attack blended extraordinarily stealthy tradecraft, using cyber tools never before seen in a previous attack, with a strategy that zeroed in on a weak link in the software supply chain that all U.S. businesses and government institutions rely on...” https://twitter.com/...
@rhifionn
Rhiannon Fionn-Bowman on x
Excerpt: ... effect of Thursday's revelations was confirmation that no single person or agency — including the highest reaches of the U.S. government — is certain of exactly what the hackers had infiltrated, let alone the full extent of what was taken. https://www.bloomberg.com/.…
@williamturton
William Turton on x
New: Members of a consortium of major financial firms that share cybersecurity information with each other and the government, expressed concern the the US govt could be so deeply penetrated that its confidential data could be seen by Russian hackers: https://www.bloomberg.com/..…