UnknownPublished 14 Dec 2020

OSINT · UNC2452 / SUNBURST @vxunderground OSINT related findings

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings

Impact

For European organizations, the impact of the UNC2452/SUNBURST threat is significant due to the potential for widespread espionage, data theft, and disruption of critical infrastructure. Organizations using SolarWinds Orion products or integrated supply chain services are at risk of having been compromised or targeted. The stealthy nature of the attack allows threat actors to maintain persistence and exfiltrate sensitive data over extended periods, potentially affecting government agencies, critical infrastructure providers, and private enterprises. The lack of specific exploit details in this OSINT entry limits immediate actionable impact but underscores the ongoing risk from this threat actor. European entities involved in IT management, telecommunications, energy, and public administration are particularly vulnerable due to their reliance on SolarWinds products and the strategic value of their data. The reputational damage and operational disruption from such supply chain compromises can be severe, affecting trust and compliance with data protection regulations such as GDPR.

Defensive guidance

European organizations should implement enhanced monitoring for indicators of compromise related to UNC2452 and SUNBURST, including network traffic analysis and endpoint detection for known SUNBURST signatures. Conduct thorough audits of SolarWinds Orion deployments and related supply chain components, ensuring all software is updated to versions released after the compromise was disclosed. Employ threat intelligence feeds to stay informed about emerging indicators and tactics used by UNC2452. Strengthen supply chain risk management by vetting third-party vendors and enforcing strict code integrity checks. Implement network segmentation to limit lateral movement in case of compromise. Use multi-factor authentication and least privilege principles to reduce attack surface. Engage in incident response planning specific to supply chain attacks and consider collaboration with national cybersecurity agencies for threat sharing. Given the absence of patches in this OSINT entry, focus on detection and containment rather than remediation of a new vulnerability.

Indicators of compromise

Hashes 88

1acf3108bf1e376c8848fbb25dc87424f2c2a39c
e257236206e99f5a5c62035c9c59c57206728b28
bcb5a4dcbc60d26a5f619518f2cfc1b4bb4e4387
5e643654179e8b4cfe1d3c1906a90a4c8d611cea
ebe711516d0f5cd8126f4d53e375c90b7b95e8f2
5a1c26db5b9b9a2d0a630e63ff83f0bf
18ea74745f5c8992a95ae40bfe2158c8d7e34acf
02811d870295f78bf9aa3c9f42ca11f2838171fe73e70dbbc158fae590161573
c0e04da710f18443018aeef4ab387903f93f95a42b700a3a88b3ea7c35ae3821850f1583494172f5650a69a9acf8f9d63d1fca22aac115f1fdc4ec8b78c5d7e6
da27d86acfb9504441eebac21f66a5df

Link 6

https://vxug.fakedoma.in/samples/Exotic/UNC2452/SolarWinds%20Breach/
https://www.virustotal.com/gui/file/d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af/detection/f-d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af-1607927721
https://www.virustotal.com/gui/file/019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134/detection/f-019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134-1607927076
https://www.virustotal.com/gui/file/c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71/detection/f-c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71-1607928437
https://www.virustotal.com/gui/file/32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77/detection/f-32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77-1607931151
https://www.virustotal.com/gui/file/ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6/detection/f-ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6-1607930914

Text 61

.text
.rsrc
.reloc
dll
269460022
SolarWinds.Orion.Core.BusinessLayer
2020.2.5300.12432
000004b0
SolarWinds.Orion.Core.BusinessLayer
2020.2.5300.12432

Size in bytes 20

1018368
1536
512
1028072
924672
1536
512
934232
1018368
1536

Float 20

5.5695446259584
3.3927625723408
1.9473387961876
5.5800537860468
5.6441844251496
3.3987008123389
1.9473387961876
5.6560901874991
5.5694865540978
3.389713791853

Ssdeep 20

12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19QU:KEfDbO97P8TrK0YbenWH4c0g8vkzK19b
24:YE66ZyxF4iPXOL1+N0MnaOL1hyYinXF4OL1F3YOL15PNMMDqMM:YrjleBw0MjBhyXBB9hB7MM2MM
3:6/Pl:6/d
12288:5JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+BYvjenWHuhh9c0g8vkzK19Q:vEfDbO97P8TrK0YbenWH4c0g8vkzK19
24576:GdBfeHcrhCECR1R/zoi8SHoN0W8vB8O3IcL:qe8nK/zopSHoN0W8vB8u
24:LXsfQMKyxF4iPXOL1XNN9aOL1hninXF4OL1F3YOL1sPNelvq:LXsnjleBHJBhmBB9hB86i
3:HlZn:r
24576:ldBfeHcrhCECR1R/zoi8SHoN0W8vB8O3Icu:5e8nK/zopSHoN0W8vB83
12288:6JKoHwfn/jz3bbO4Qag2I97PMieSLezPKT+cYvjenWHuhh9c0g8vkzE19Wa:KEfDbO97P8TrKhYbenWH4c0g8vkzE19j
24:YA66ZyxF4iPXOL1+N0ZaaOL1hyYinXF4OL1F3YOL15PNMZkqMZ:YPjleBw0gBhyXBB9hB7MzM

Datetime 10

2020-05-11T21:32:40+00:00
2019-10-10T13:26:39+00:00
2020-04-21T14:53:33+00:00
2020-03-24T08:52:34+00:00
2020-03-24T09:16:10+00:00
2020-12-14T06:35:21+00:00
2020-12-14T06:24:36+00:00
2020-12-14T06:47:17+00:00
2020-12-14T07:32:31+00:00
2020-12-14T07:28:34+00:00

File 15

SolarWinds.Orion.Core.BusinessLayer.dll
SolarWinds.Orion.Core.BusinessLayer.dll
ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
SolarWinds.Orion.Core.BusinessLayer.dll
SolarWinds.Orion.Core.BusinessLayer.dll
a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc
SolarWinds.Orion.Core.BusinessLayer.dll
SolarWinds.Orion.Core.BusinessLayer.dll
019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134
SolarWinds.Orion.Core.BusinessLayer.dll

Counter 5

Malware sample 5

ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6|846e27a652a5e1bfbd0ddd38a16dc865
a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc|e18a6a21eb44e77ca8d739a72209c370
019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134|2c4a910a1299cdae2a4e55988a2f102e
32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77|b91ce2fa41029f6955bff20079468448
c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71|56ceb6d0011d87b6e4d7023d7ef85676

Mime type 5

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

Community reviews

Loading reviews…