News
Supply chain attack · United States / Global · December 2020
SolarWinds Orion Supply Chain Compromise
Trojanised updates of the SolarWinds Orion platform gave attackers covert access to government and corporate networks.
Incident
What happened
Attackers inserted malicious code into the build process for SolarWinds Orion software updates.
Signed, updates that appeared legitimate were installed by thousands of customers.
Selected victims were further compromised, including through abuse of identity and cloud services.
Analysis
Lessons learned
Trusted vendor software can become an attack vector.
Monitoring and privileged access controls are needed even for management tools.
Identity infrastructure, including federation, must be protected and tested.
Prevention
How penetration testing helps
Active Directory and cloud assessments examine privileged access, trust relationships, and identity paths attackers use after initial access.
Sources
Summary based on publicly available information. DIGITPOL was not involved in this incident.