Malware

Threat Brief: SolarStorm and SUNBURST Customer Coverage

Clock Icon 14 min read
Related Products
Advanced DNS Security iconAdvanced DNS SecurityAdvanced Threat Prevention iconAdvanced Threat PreventionAdvanced URL Filtering iconAdvanced URL FilteringAdvanced WildFire iconAdvanced WildFireCortex XDR iconCortex XDRCortex XSOAR iconCortex XSOARIoT Security iconIoT SecurityManaged Threat Hunting iconManaged Threat HuntingNext-Generation Firewall iconNext-Generation Firewall

This post is also available in: 日本語 (Japanese)

Conclusion

The protections in place for our customers are continually being updated for this related threat activity and for all threats that are identified in the wild. Customers should know that Unit 42 researchers are working diligently to ensure protections are in place for our entire product ecosystem.

While Palo Alto Networks has deployed effective countermeasures to help protect customers, there are some additional safeguards organizations leveraging SolarWinds can take:

  • Identify all SolarWinds servers inside your organization, isolate them from the rest of the network and block internet-facing traffic from them.
  • Search for indicators of the SUNBURST, TEARDROP and BEACON malware in network and endpoint logs.
  • Evaluate SolarWinds’ Guidelines for future system updates, found in the Additional Resources section

There’s been a litany of press surrounding this event, with several sources releasing information, including SolarWinds. A selection of key information is listed in the section below.

Appendix

Additional Resources

Indicators of Compromise (IOCs)

freescanonline[.]com

deftsecurity[.]com

thedoccloud[.]com

websitetheme[.]com

highdatabase[.]com

incomeupdate[.]com

databasegalore[.]com

panhardware[.]com

zupertech[.]com

Virtualwebdata[.]com

virtualdataserver[.]com

digitalcollege[.]org

lcomputers[.]com

webcodez[.]com

deftsecurity[.]com

globalnetworkissues[.]com

kubecloud[.]com

seobundlekit[.]com

solartrackingsystem[.]net

a7240d8a7aee872c08b915a58976a1ddee2ff5a8a679f78ec1c7cf528f40deed

5fabe36fb1da700a1c418e184c2e5332fe2f8c575c6148bdac360f69f91be6c2

e9e646a9dba31a8e3debf4202ed34b0b22c483f1aca75ffa43e684cb417837fa

b9cf6fbde82839e15413595a50aeb1044a8f4e3be180c42436e11675c22cf914

02f47b88caa73d607d820d258cd9f167ed266af99a62e10c9220a7e0228cf53e

c0fc006ffa92d0111197f8e3a1d2ba06a326eddc3d0b28111727df8e52805cf8

b05640e8f35761435e3cf22524136808a891304f10ec9f354eb9decc43cb617e

32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77

ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6

019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134

ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c

c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71

6e4050c6a2d2e5e49606d96dd2922da480f2e0c70082cc7e54449a7dc0d20f8d

118189f90da3788362fe85eafa555298423e21ec37f147f3bf88c61d4cd46c51

Updated Jan. 15, 2021, at 4:45 p.m. PT.

Back to Top

Tags

Table of Contents

Related Articles

Related Malware Resources

Pictorial representation of FrostyGoop malware. Close-up view of a digital screen displaying a pixelated, abstract image, possibly representing a face.
category iconThreat Research

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Read now Right arrow
Pictorial representation of a threat like the Bring Your Own Vulnerable Driver (BYOVD) technique. Image of computer code on a screen with a prominent biohazard symbol.
category iconThreat Research

TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit
Read now Right arrow
Pictorial representation of a campaign like Contagious Interview. Digital graphic of a glowing globe with network connections and data streams, symbolizing global connectivity and technology advancements.
category iconThreat Research

Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware
Read now Right arrow
A pictorial representation of machine learning detecting vulnerability scanning. A Black man using a tablet with a background of illuminated city buildings at night.
category iconThreat Research

Detecting Vulnerability Scanning Traffic From Underground Tools Using Machine Learning
Read now Right arrow
Pictorial representation of keylogger malware like KLogEXE and FPSpy. Person working on a laptop with lines of code displayed on the screen, with a blurred effect indicating motion or activity, surrounded by a vivid blue and red lighting.
category iconThreat Actor Groups

Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy
Read now Right arrow
Pictorial representation of SnipBot. Digital abstract background featuring binary code and technology symbols with a blue glow in the shape of a skull.
category iconThreat Research

Inside SnipBot: The Latest RomCom Malware Variant
Read now Right arrow
A pictorial representation of a red team tool like Splinter. A digital illustration showing a 3D brain model surrounded by rising data columns on a circuit board, representing advanced artificial intelligence technology.
category iconThreat Research

Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool
Read now Right arrow
Pictorial representation of APT groups from North Korea. The silhouette of two fish and the Pisces constellation inside an orange abstract planet, surrounded by two larger blue fish. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.
category iconThreat Actor Groups

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors
Read now Right arrow
Illustrative image featuring two fish and the Pisces constellation superimposed on a stylized, abstract background with flowing purple waves and a starry night sky.
category iconHigh Profile Threats

Threat Assessment: North Korean Threat Groups
Read now Right arrow
Pictorial representation of Stately Taurus' updated TTPs. Illustration of a bull's head and the Taurus constellation inside a stylized orange moon, set against the profile of a much larger bull's head. Shooting stars are on the dark background.
category iconThreat Actor Groups

Chinese APT Abuses VSCode to Target Government in Asia
Read now Right arrow
Enlarged Image

Default Heading

Read the article Right Arrow