Inside the Mind of the SUNBURST Adversary
summary
An adversary compromises the SolarWinds Orion build chain to inject a backdoor that signs and ships with legitimate updates, successfully reaching 18,000 downstream customers. The implant hides in a long‑running task, uses simple hashing to skip security products, sits dormant for 12–14 day dormancy then phones home; attackers rehearse in QA, test for detection for months, and disable services. Outcome: targeted selection of high‑value victims and stolen API keys/IAM access that gives cloud admin control.
AI-written summary · about
chapters (17)
- 0:00Who is Marco Figueroa
- 0:28The Mindset of an Adversary
- 1:19The Anatomy of the Solar Winds Attack
- 2:14SolarWinds Attack Timeline - Overview
- 3:09Transparency is key
- 5:22Red Teamer: Reconnaissance
- 7:17Red Team: New Admin
- 9:03How was the Build Process Compromised
- 10:09Red Team: Pinpoint Precision
- 11:10Code Analysis Of Sunburst
- 11:56Tamper Proof
- 13:30SUNBURST Explained
- 14:06Red Team: Knowing Thy Enemy
- 15:49Skelton Key Details
- 18:26Red Team: Ghost in a Shell
- 22:24Solar Winds Attack Timeline
- 23:40Key Takeaway
related talks
23mSolarWinds: What Really Happened?
34mThe SolarWinds Supply Chain Compromise
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
58mAttacking through the Software Supply Chain
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
37mKeynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supp...
50mInsights into New Supply Chain and Cloud-Identity Attacks
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain