In many of their actions, the attackers took steps to maintain a low profile. As a result, the DLL containing the malicious code is also digitally signed, which enhances its ability to run privileged actions-and keep a low profile. Therefore, insertion of malicious code into the .dll likely occurred at an early stage, before the final stages of the software build, which would include digitally signing the compiled code. Evidence suggests that as early as October 2019, these attackers have been testing their ability to insert code by adding empty classes. The fact that the compromised file is digitally signed suggests the attackers were able to access the company’s software development or distribution pipeline.

The discreet malicious codes inserted into the DLL called a backdoor composed of almost 4,000 lines of code that allowed the threat actor behind the attack to operate unfettered in compromised networks. The addition of a few benign-looking lines of code into a single DLL file spelled a serious threat to organizations using the affected product, a widely used IT administration software used across verticals, including government and the security industry. While the full extent of the compromise is still being investigated by the security industry as a whole, in this blog we are sharing insights into the compromised SolarWinds Orion Platform DLL that led to this sophisticated attack. We have established a resource center that is constantly updated as more information becomes available at.

While investigations are underway, we want to provide the defender community with intelligence to understand the scope, impact, remediation guidance, and product detections and protections we have built in as a result. We, along with the security industry and our partners, continue to investigate the extent of the Solorigate attack. As we release new content and analysis, we will use NOBELIUM to refer to the actor and the campaign of attacks. Microsoft Threat Intelligence Center (MSTIC) has named the actor behind the attack against SolarWinds, the SUNBURST backdoor, TEARDROP malware, and related components as NOBELIUM. Microsoft previously used ‘Solorigate’ as the primary designation for the actor, but moving forward, we want to place appropriate focus on the actors behind the sophisticated attacks, rather than one of the examples of malware used by the actors. UPDATE: Microsoft continues to work with partners and customers to expand our knowledge of the threat actor behind the nation-state cyberattacks that compromised the supply chain of SolarWinds and impacted multiple other organizations.

SSO solution: Secure app access with single sign-on.

Identity & access management Identity & access management.

App & email security App & email security.

Fully sign a dll file