Unprecedented Malware Attack Targets U.S. Government Agencies

Americans received the news in December that U.S. government and other agencies fell victim to a highly organized cyberattack. Those affected are still calculating the scope of the unprecedented attack and the extent of data it may have compromised. Authorities were able to determine how such a massive and highly sophisticated malware attack had infiltrated critical U.S. government agencies and over 200 organizations in this country and abroad.

The U.S. national security agencies released a joint statement saying the “significant and ongoing hacking campaign” gave hackers a wide range of opportunity to infiltrate data systems. Recent findings show the malware stayed in data systems for six to nine months before being discovered.

The list of affected agencies continues to grow with the investigation, and includes the Department of Energy, Homeland Security, National Institutes of Health, Treasury Department, and the Cybersecurity and Infrastructure Agency (CISA). Likely, more will be discovered in the upcoming weeks and months. U.S. security agencies determined, in a joint statement released by CISA, “…this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations…”

2

The question of how such an extensive and damaging attack took place has been at least partially answered. Microsoft and FireEye, a cybersecurity provider involved in the detection and prevention of major cyberattacks, were hacked first. It’s believed these two attacks helped the malware spread as insidiously as it has. Their analysis finds hackers were able to access SolarWinds, a third-party software supplier to those impacted. The company’s Orion product provides software updates to SolarWinds for distribution to their customers, including U.S government agencies. The malicious code called SUNBURST infiltrated Orion and was then released by SolarWinds. Once distributed, the update infected the victims and gave it unfettered access to their data systems.

2

This unprecedented malware infection is called a supply-chain attack since third-party software was infected during its assembly. It also helped the malware’s ability to remain undetected throughout its distribution. These attacks give the malware the ability to hide in a trusted and legitimate software update. Rather than relying on a hit-or-miss email phishing campaign to infect a system, hackers knew the update would be trusted and installed with direction from SolarWinds. The company found approximately 18,000 of their customers installed the infected software into their systems.

2

As the affected government agencies and organizations continue to understand the scope of the attack and the data that was compromised, some recent good news is welcomed. A reminder, the name of the malware distributed through SolarWinds is known as SUNBURST. Collaboration between FireEye, Microsoft, and GoDaddy identified what’s called a “kill switch” for the SUNBURST malware. This kill switch deactivates the malware infection, leading it to terminate itself and prevent further system infection. This discovery also affects new and prior SUNBURST infections by disabling further distribution of the malware.

2

Right now, it’s not known what to do if you may have been affected by this. First, immediately take a look at your logs and look for indicators of compromise. FireEye published a list of what to look for which can be found on Github. Then continue looking for the indicators. This is not a one-and-done situation. Don’t forget to look at firewall logs and check key systems like Network Monitoring tools, Configuration and Patch Management tools, and Domain Controllers.

If you do find compromised systems:

• Isolate infected systems immediately.
• Change passwords or if possible, decommission the account.
• Continue to monitor logs for compromised devices and remove them from the network.

There are additional recommendations for updating on the SolarWinds website in a security advisory, including updating the Orion platform to versions 2019.4 HF 6 or 2020.2.1 HF 2.

Because this is ongoing, it’s important to keep checking available resources like SolarWinds’ security advisories.