Résumé
Disclosed in December 2020, SolarWinds was the most consequential software supply-chain attack ever uncovered. Russia's foreign-intelligence service, the SVR (the group known as APT29 or Cozy Bear), broke into the build pipeline of SolarWinds Orion, a network-monitoring platform used across the US government and the Fortune 500, and slipped a backdoor named SUNBURST into the official, signed software updates. Up to 18,000 organisations installed the trojanized update, and from that pool the attackers hand-picked around 100 ultra-high-value targets, including multiple US federal agencies, Microsoft, and the security firm FireEye, for deep, months-long espionage. The intrusion went undetected for over a year and was found only when FireEye, itself a victim, noticed its own hacking tools had been stolen. It is the defining supply-chain-espionage case and a permanent argument that "signed and trusted" does not mean safe.
How it happened
The attackers, a patient and well-funded APT tied to Russian intelligence, did not attack SolarWinds' customers. They attacked the machine that builds SolarWinds' software. Having quietly compromised the company's development environment, they planted a custom implant (which CrowdStrike later named SUNSPOT) on the build server. SUNSPOT watched for Orion being compiled, swapped in a backdoored version of one source file only during the build, then restored the original and checked file hashes to cover its tracks, even suppressing compiler warnings so nothing looked off. This is the crucial detail: the source code in the repository stayed clean, so a developer reviewing it would see nothing wrong. The malware was injected during compilation, after the code anyone could read.
The resulting Orion updates were genuine in every checkable way, compiled by SolarWinds, signed with SolarWinds' certificate, and delivered through the normal automatic-update channel, which is why up to 18,000 organisations installed them without suspicion. SUNBURST then behaved with extreme discipline: it lay dormant for about two weeks, disguised its traffic to look like normal Orion telemetry, and checked it was not running in a security researcher's environment before doing anything. Only for a small, carefully chosen set of high-value targets did it pull down a second stage, and for the most valuable ones the attackers pivoted into the cloud with Golden SAML: they stole the token-signing certificate from the victim's identity system and used it to mint valid authentication tokens for any user, reading Microsoft 365 email with no password and leaving no normal login trail. It was a supply-chain attack in service of precision espionage.
The damage
The intrusion began in September 2019, and the trojanized updates shipped from roughly March to June 2020, but the whole operation went undiscovered for over a year. Of the ~18,000 organisations that received the backdoor, the attackers actively exploited around 100 companies and nine US federal agencies, reportedly including the Treasury, Commerce, State, Homeland Security, and Energy departments, along with Microsoft, Intel, and Cisco. The result was months of undetected access to the email and internal data of large parts of the US government. It surfaced only in December 2020, when FireEye, investigating an unfamiliar device that had enrolled itself in an employee's multi-factor authentication, unravelled the theft of its own red-team tools and traced it to Orion. A partial kill switch helped: Microsoft, FireEye, and GoDaddy seized SUNBURST's command domain (avsvmcloud.com) and repointed it to neutralise first-stage infections, though it did nothing where the attackers had already dug deeper. In April 2021 the US formally attributed the operation to the SVR and responded with sanctions. The fallout reshaped policy, driving the US executive order on cybersecurity and the push for software bills of materials. The SEC charged SolarWinds and its security chief in October 2023 over how the company had described its defences, but a court dismissed most of the case in July 2024, and the SEC dropped the rest, with prejudice, in late 2025.
Why SolarWinds still matters
SolarWinds is the high-water mark of supply-chain espionage and the case that made the whole industry take the threat seriously. It proved several things at once. The build pipeline is the ultimate target, because compromising it once compromises every customer who trusts the vendor. A valid signature certifies origin, not safety; the trojanized updates were perfectly signed. The cloud identity layer is the modern pivot: after the foothold, forged SAML tokens turned a software backdoor into full access to cloud email, with no password and no on-premises trace. And dwell time can stretch past a year against a careful adversary. Together with CCleaner before it and Kaseya after, it defined the supply-chain era and drove the move toward verified builds, signed provenance (SLSA), and SBOMs.
Comment le corriger
- Treat the trojanized component as fully compromised: remove it, rebuild affected hosts, and rotate every credential, key, and token it could reach.
- Hunt for second-stage implants and identity abuse (forged SAML tokens, rogue OAuth grants, new federation trusts), not just the known backdoor signatures.
- Rebuild the build pipeline itself from trusted media and rotate code-signing keys; a clean source repository does not mean the build was clean.
- Reset the trust fabric: re-issue the token-signing certificate (the Golden SAML key) and review every cloud application and federation relationship.
Comment l’éviter
- Treat the build and CI pipeline as crown jewels: isolate it, enforce least privilege and MFA, and monitor build hosts for tampering, not just source commits.
- Require reproducible, verified builds with signed provenance (SLSA) and an SBOM, so what ships can be proven to match the source.
- Protect code-signing and token-signing keys in hardware, and remember a valid signature proves origin, not safety.
- Watch the identity layer downstream: alert on forged or anomalous SAML tokens, new federation trusts, and unexpected OAuth grants.
- Segment and monitor what privileged monitoring and management software can reach, so one trojanized agent is not a key to everything.
Références
- https://www.crowdstrike.com/en-us/blog/sunspot-malware-technical-analysis/
- https://www.cisa.gov/news-events/news/remediating-networks-affected-solarwinds-and-active-directorym365-compromise
- https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise
- https://attack.mitre.org/campaigns/C0024/
- https://www.rapid7.com/blog/post/2020/12/14/solarwinds-sunburst-backdoor-supply-chain-attack-what-you-need-to-know/
Vulnérabilités liées
Tout Supply chain →- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-SHAI-HULUD-2-2025
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.