IT management company SolarWinds confirmed that updates to its Orion software had been tampered with to include a backdoor. The US Cybersecurity and Infrastructure Security Agency issued an emergency directive ordering federal agencies to disconnect affected systems.
What happened
- The malicious updates were distributed between March and June 2020, and SolarWinds said up to around 18,000 customers downloaded them.
- The compromise was uncovered after security firm FireEye disclosed a breach of its own systems.
- Victims included the US Treasury and Commerce departments, among other government bodies and companies.
- In April 2021 the US and UK governments attributed the campaign to Russia’s Foreign Intelligence Service (SVR).
Why it mattered
It was one of the most significant cyber espionage campaigns ever uncovered and changed how governments and businesses view software supply chain risk. The campaign went undetected for months despite reaching some of the best-defended networks in the world.
Lessons for organisations
Assess the security of software suppliers, monitor privileged management tools for unusual behaviour, and apply least privilege to systems with broad network access. Keep detailed logs long enough to investigate intrusions that may have started months earlier.
Sources: CISA, Krebs on Security
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
