SUNBURST

MITRE ATT&CK: S0559 View on attack.mitre.org

Aliases: Solorigate, SUNBURST

Malware type
trojan, backdoor
Family
Malware family
Operating systems
windows
Related IoCs
19 (16 malicious)
Last IoC activity
2026-10-18 02:59:35
Profile updated
2026-07-07 12:37:37

Targeted industries: government-and-public-sector technology-and-telecommunications financial-services energy-and-utilities healthcare-and-pharmaceutical

Targeted regions: country_code:us country_code:gb country_code:de

Context

SUNBURST is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by APT29 since at least February 2020.

Recent IoC activity

16 malicious indicators in Maltiverse are attributed to SUNBURST (S0559). The 16 most recently updated:

TypeIndicatorUpdatedSources
hostname thedoccloud.com 2026-10-18 4
hostname databasegalore.com 2026-10-18 4
hostname deftsecurity.com 2026-10-18 4
hostname freescanonline.com 2026-10-18 4
hostname digitalcollege.org 2026-10-18 4
hostname avsvmcloud.com 2026-10-18 5
hostname zupertech.com 2026-10-18 4
hostname websitetheme.com 2026-10-18 3
hostname highdatabase.com 2026-10-18 3
hostname virtualdataserver.com 2026-10-18 4
file sample SolarWinds.Orion.Core.BusinessLayer.dll 2026-10-12 2
file sample SolarWinds.Orion.Core.BusinessLayer.dll 2026-10-09 2
file sample SolarWinds.Orion.Core.BusinessLayer.dll 2026-10-08 2
file sample SolarWinds.Orion.Core.BusinessLayer.dll 2026-08-15 2
file sample tmpwfi0uyqe 2026-07-10 2
file sample task5.zip 2026-07-09 1

Detection coverage

  • 3 YARA rules
  • 728 Sigma rules

Malware & tools used

  • Time Based Checks (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Modify Registry (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Clear Persistence (attack-pattern)
  • Data from Local System (attack-pattern)
  • System Time Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Image File Execution Options Injection (attack-pattern)
  • Rundll32 (attack-pattern)
  • Compression (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Code Signing (attack-pattern)
  • Process Discovery (attack-pattern)
  • Protocol or Service Impersonation (attack-pattern)
  • Junk Data (attack-pattern)
  • Visual Basic (attack-pattern)
  • DNS (attack-pattern)
  • File Deletion (attack-pattern)

Used by threat actors

  • SolarWinds Compromise (campaign)
  • APT29 (threat-actor)

Detection rules

  • SIGNATURE_BASE_APT_Backdoor_SUNBURST_1 (yara-rule)
  • SIGNATURE_BASE_APT_Backdoor_SUNBURST_2 (yara-rule)
  • SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings (yara-rule)

Reports & references

  • medium.com — Identifying Unc2452 Related Techniques 9F7B6C7F3714 (report)
  • Mandiant — Evasive Attacker Leverages Solarwinds Supply Chain Compromises With Sunburst Backdoor (report)
  • news.sophos.com — How Sunburst Malware Does Defense Evasion (report)
  • Microsoft — Analyzing Solorigate The Compromised Dll File That Started A Sophisticated Cyberattack And How Microsoft Defender Helps Protect (report)
  • pastebin.com — 6Edgckxd (report)
  • github.com — Sunburst Countermeasures (report)
  • Microsoft — Goldmax Goldfinder Sibot Analyzing Nobelium Malware (report)
  • Palo Alto Unit 42 — Solarphoenix (report)
  • CrowdStrike — Report2021Gtr (report)
  • Palo Alto Unit 42 — Solarstorm Supply Chain Attack Timeline (report)
  • CrowdStrike — Sunspot Malware Technical Analysis (report)
  • volexity.com — Dark Halo Leverages Solarwinds Compromise To Breach Organizations (report)
  • Palo Alto Unit 42 — Strategically Aged Domain Detection (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • wired.com — Hacker Lexicon What Is A Supply Chain Attack (report)
  • Kaspersky — 99981 (report)
  • youtu.be — Sw8Kvkwdorc (report)
  • blog.bushidotoken.net — Space Invaders Cyber Threats That Are (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Sunburst (report)
  • go.recordedfuture.com — Pov 2020 1230 (report)
  • twitter.com — 1338305089597964290 (report)
  • blog.truesec.com — Avoiding Supply Chain Attacks Similar To Solarwinds Orions Sunburst (report)
  • Microsoft — Using Microsoft 365 Defender To Coordinate Protection Against Solorigate (report)
  • cyborgsecurity.com — Sunburst Solarwinds Supply Chain Attack (report)
  • ics-cert.kaspersky.com — Sunburst Industrial Victims (report)

External references